High · published November 19, 2025
⚡ A sneaky flaw in Piwigo's password reset function could let an attacker hijack account recovery requests with a clever hostname trick! 🔍 Think of it like a delivery service that doesn’t check the address before sending out a package — they might deliver it to a totally different house if you just change the label! 📦 An attacker could easily send a malicious password reset URL to any existing user, potentially allowing them to take control of the victim's account. It's like presenting a fake ID at a club, gaining unauthorized access and wreaking havoc! 😱
Think of it like a delivery service that doesn’t check the address before sending out a package — they might deliver it to a totally different house if you just change the label! 📦 This vulnerability arises because Piwigo uses the Host header from HTTP requests to create password-reset URLs without proper validation, making it possible for attackers to manipulate it.
An attacker could easily send a malicious password reset URL to any existing user, potentially allowing them to take control of the victim's account. It's like presenting a fake ID at a club, gaining unauthorized access and wreaking havoc! 😱 Upgrade to Piwigo version 15.7.0 immediately to patch this vulnerability. Also, consider implementing additional hostname validation to prevent similar issues in the future. 🛡️ You've got this! Stay on top of your updates, and you’ll keep your photo gallery safe and sound! 📸✨
| Product | Versions | Fixed in |
|---|---|---|
| piwigo/piwigo | all versions | — |