CVE-2026-84441: Piwigo Path Traversal Vulnerability

CVE-2026-84441 Overview

CVE-2026-84441 is a path traversal vulnerability [CWE-22] in Piwigo up to version 16.3.0. The flaw resides in the Image Derivative Handler component, specifically within the i.php file. An attacker can manipulate request parameters to traverse outside the intended directory and access files on the server. Exploitation is remote and does not require authentication. A public proof-of-concept has been disclosed, increasing the likelihood of opportunistic scanning against exposed Piwigo instances.

Critical Impact
Unauthenticated remote attackers can read arbitrary files accessible to the web server process by abusing the derivative image handler, exposing configuration data, credentials, and other sensitive resources.

Affected Products

Piwigo photo gallery software, versions up to and including 16.3.0
Deployments exposing the i.php Image Derivative Handler endpoint
Self-hosted Piwigo instances reachable over the network

Discovery Timeline

2026-09-02 - CVE-2026-84441 published to the National Vulnerability Database (NVD)
2026-09-02 - Last updated in NVD database
2026-09-02 - EPSS score published

Technical Details for CVE-2026-84441

Vulnerability Analysis

The vulnerability is a classic path traversal weakness in Piwigo's image derivative subsystem. The i.php handler generates and serves resized or transformed image variants based on parameters supplied in the HTTP request. Because the handler does not adequately validate or canonicalize the file path derived from user input, an attacker can inject traversal sequences such as ../ to escape the intended media directory. The result is unauthenticated read access to files elsewhere on the filesystem within the web server's permission scope.

Root Cause

The root cause is insufficient input validation on the request parameter that identifies the source image for derivative generation. The handler concatenates the attacker-controlled value into a filesystem path without normalizing it or enforcing a strict allowlist confined to the gallery's media directory. This maps directly to [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Exploitation occurs over the network against the i.php endpoint. An unauthenticated attacker issues an HTTP request containing traversal sequences in the parameter consumed by the Image Derivative Handler. The server resolves the manipulated path and returns file contents outside the gallery root. See the public proof-of-concept for Piwigo 16.3.0 for the request structure and technical breakdown.

No verified code examples are available for reproduction here. Refer to the VulDB entry for CVE-2026-84441 for additional technical details.

Detection Methods for CVE-2026-84441

Indicators of Compromise

HTTP GET requests to i.php containing traversal sequences such as ../, ..%2f, or encoded variants in query parameters.
Web server access log entries showing successful 200 responses from i.php when the referenced path resolves outside the Piwigo media directory.
Unexpected reads of sensitive files such as /etc/passwd, wp-config equivalents, or Piwigo configuration files traced back to the derivative handler.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect requests to i.php for path traversal patterns and reject encoded traversal sequences.
Correlate access logs to identify a single client requesting i.php with anomalous path parameters at high frequency, suggesting enumeration.
Monitor filesystem audit logs for the web server user reading files outside the Piwigo installation directory.

Monitoring Recommendations

Enable verbose logging on the Piwigo web tier and forward logs to a centralized analytics platform for baseline comparison.
Alert on outbound responses from i.php where the returned content type does not match an image MIME type.
Track new Piwigo installations across the estate to ensure they are inventoried and patched consistently.

How to Mitigate CVE-2026-84441

Immediate Actions Required

Restrict network exposure of Piwigo instances running 16.3.0 or earlier until a vendor-supplied fix is applied.
Deploy WAF signatures that block traversal patterns targeting the i.php endpoint.
Audit web server logs for prior exploitation attempts referencing the public proof-of-concept.
Rotate any credentials or secrets stored in files that may have been readable by the web server process.

Patch Information

At the time of publication, no fixed release is referenced in the NVD entry. Monitor the VulDB CVE-2026-84441 record and official Piwigo release channels for a security update, and apply it as soon as it becomes available.

Workarounds

Place Piwigo behind an authenticated reverse proxy to prevent unauthenticated access to i.php.
Configure the web server to reject requests containing .., %2e%2e, or other traversal encodings before they reach PHP.
Run the web server process under a least-privilege user account with filesystem access strictly limited to the Piwigo installation directory.
Disable the derivative handler if it is not required by the deployment.

bash

# Example nginx rule to block traversal attempts against i.php
location = /i.php {
    if ($args ~* "(\.\./|\.\.%2f|%2e%2e/)") {
        return 403;
    }
}