A reflected cross‑site scripting flaw exists in Piwigo 16.3.0, triggered by manipulating the "lang" argument on the Public Authentication Page. The vulnerability is a classic input validation issue, covered by CWE-79, and is combined with a code injection pathway identified by CWE-94. Successful exploitation could allow an attacker to embed crafted scripts that run in the browser of any user who processes the "lang" parameter, potentially enabling cookie theft, session hijacking, or defacement of the victim’s view of the site.

The flaw affects the Piwigo content‑management system, version 16.3.0. Any installation relying on that version is susceptible. Upgrading to 16.4.0 resolves the issue.

The CVSS score of 2.3 indicates a low overall severity. The required exploitation steps involve remote input manipulation and high complexity, making widespread attacks less likely. EPSS data is unavailable and the vulnerability is not listed in the KEV catalog. The attack path is remote but requires a user to visit a crafted URL, which limits the attack surface to browsers that can execute the injected script; this requirement is inferred from the described reflected XSS.