CVE-2025-62512: Piwigo Information Disclosure Vulnerability

CVE-2025-62512 Overview

CVE-2025-62512 is a user enumeration vulnerability in Piwigo, an open source photo gallery application for the web. The password reset functionality in Piwigo version 15.5.0 and likely earlier 15.x releases allows an unauthenticated attacker to determine whether a given username or email address exists in the system. The endpoint at password.php?action=lost returns distinct messages for valid vs. invalid accounts, enabling user enumeration attacks.

Critical Impact

Attackers can harvest valid usernames and email addresses from Piwigo installations, facilitating targeted phishing campaigns, credential stuffing attacks, and brute-force login attempts against confirmed accounts.

Affected Products

• Piwigo version 15.5.0
• Earlier Piwigo 15.x releases (likely affected)
• All Piwigo installations with exposed password reset functionality

Discovery Timeline

• 2026-02-24 - CVE CVE-2025-62512 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2025-62512

Vulnerability Analysis

This vulnerability is classified under CWE-204 (Observable Response Discrepancy), which occurs when an application returns different responses based on whether a user account exists. In Piwigo's password reset implementation, the password.php script with the action=lost parameter provides distinguishable responses when processing password reset requests for valid versus invalid accounts.

The vulnerability requires no authentication and can be exploited remotely over the network with low attack complexity. An attacker can systematically probe the application with various usernames or email addresses and analyze the response messages to build a list of valid accounts within the system.

Root Cause

The root cause stems from inadequate response normalization in Piwigo's password reset workflow. When a user submits a password reset request, the application fails to return uniform responses regardless of whether the submitted username or email exists in the database. This differential response behavior violates the principle of security through obscurity and creates an information disclosure channel.

The password reset endpoint should implement consistent messaging that neither confirms nor denies account existence, typically by displaying a generic message such as "If an account exists with this email, a password reset link will be sent."

Attack Vector

The attack vector is network-based and requires no prior authentication or special privileges. An attacker can exploit this vulnerability by:

1. Sending HTTP requests to the password.php?action=lost endpoint with various username or email combinations
2. Analyzing the response messages returned by the server
3. Identifying valid accounts based on response differences
4. Compiling a list of confirmed usernames for subsequent attacks

This enumerated account information can then be leveraged for credential stuffing attacks using leaked password databases, targeted phishing campaigns against confirmed users, brute-force password attacks against known valid accounts, or social engineering attempts directed at specific users.

Detection Methods for CVE-2025-62512

Indicators of Compromise

• Unusually high volume of password reset requests from single IP addresses
• Sequential or patterned username/email submissions to password.php?action=lost
• Multiple failed password reset attempts across different usernames in short time windows
• Automated request patterns with consistent timing intervals

Detection Strategies

• Monitor HTTP access logs for repeated requests to password.php?action=lost from the same source
• Implement rate limiting detection on password reset endpoints
• Alert on anomalous spikes in password reset request volumes
• Deploy web application firewall (WAF) rules to identify enumeration patterns

Monitoring Recommendations

• Configure log aggregation for all requests to authentication and password reset endpoints
• Establish baseline metrics for normal password reset request volumes
• Implement real-time alerting for threshold violations on reset requests
• Review access logs regularly for enumeration attempt patterns

How to Mitigate CVE-2025-62512

Immediate Actions Required

• Implement rate limiting on the password.php?action=lost endpoint
• Add CAPTCHA challenges to password reset forms to deter automated enumeration
• Consider temporarily restricting access to the password reset functionality from untrusted networks
• Deploy WAF rules to detect and block enumeration attempts

Patch Information

As of the publication date, no known patches are available from the vendor. Organizations should monitor the Piwigo GitHub Security Advisory for updates on remediation guidance and patch availability. SentinelOne Singularity platform customers benefit from behavioral detection capabilities that can identify enumeration attack patterns targeting web applications.

Workarounds

• Modify the password reset response logic to return identical messages regardless of account existence
• Implement progressive delays on repeated password reset requests from the same IP address
• Deploy a reverse proxy with rate limiting capabilities in front of Piwigo instances
• Consider implementing account lockout policies after multiple reset attempts

# Example: Rate limiting configuration for Nginx reverse proxy
# Add to server or location block for password.php

limit_req_zone $binary_remote_addr zone=password_reset:10m rate=5r/m;

location ~ ^/password\.php {
    limit_req zone=password_reset burst=2 nodelay;
    limit_req_status 429;
    # Pass to PHP handler
    include fastcgi_params;
    fastcgi_pass unix:/var/run/php-fpm.sock;
}