Piwigo’s logo upload routine checks only the MIME type of the uploaded file, but then copies the original extension into the stored filename. An authenticated administrator can therefore upload image content that carries a server‑executable extension, causing the file to be placed in a web‑accessible directory and executed when requested. This achieves arbitrary command execution, allowing the attacker to read, modify, or delete data, establish persistence, or disrupt service. The flaw is an instance of insecure file upload (CWE-434).

All installations of Piwigo older than version 16.4.0 are affected, regardless of deployment size. The vulnerability exists wherever the admin/themes_standard_pages.php script handles logo uploads and the administrator role has permission to upload logos. Inferred that any site hosting a public instance with administrative credentials is at risk if not patched. No additional environment or network constraints are required.

With a CVSS score of 9.1 the flaw is considered critical. The required conditions are privileged access (an authenticated administrator) and the ability to upload a logo file. EPSS is not available, so the probability of exploitation cannot be quantified from public data. The vulnerability is not listed in CISA’s KEV catalog, but the combination of privileged access and a web‑executable file means the attacker can run arbitrary code. Immediate remediation is essential to prevent exploitation.