The vulnerability in the image upload handling of Piwigo versions prior to 16.4.0 allows an attacker to supply specially crafted image files that are processed by the Imagick library. By exploiting format confusion—such as disguising SVG content as a PNG—the application can inadvertently interpret embedded SVG elements that reference local files. In advanced configurations, the Imagick support for the Magick Scripting Language can be abused to run attacker-provided script commands, potentially resulting in unauthorized file writes or execution of code on the server. The primary impact is that an attacker who can upload images can read arbitrary files from the host filesystem or execute code, leading to full compromise of the web application and its underlying server.

Vendors and products affected are Piwigo by Piwigo. All releases before v16.4.0 are vulnerable. The fix is applied in release 16.4.0. No additional version details are provided beyond that the patched release is 16.4.0 or newer.

The overall severity is high, reflected by a CVSS score of 7.2. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker would exploit the flaw by uploading a malicious image through the web interface, which may require authenticated access to that feature in certain deployments. Once the image is processed, the attacker can read sensitive server files or execute code, depending on the system configuration and the use of the unfamiliar Magick Scripting Language. Given the lack of publicly available exploitation evidence, the risk is moderate to high but may increase if attackers discover automated upload vectors or if the Exploit database gains a working PoC.