SecuriTricks - CVE-2025-62406

Description

Piwigo is a full featured open source photo gallery application for the web. In Piwigo 15.6.0, using the password reset function allows sending a password-reset URL by entering an existing username or email address. However, the hostname used to construct this URL is taken from the HTTP request's Host header and is not validated at all. Therefore, an attacker can send a password-reset URL with a modified hostname to an existing user whose username or email the attacker knows or guesses. This issue has been patched in version 15.7.0.

Product(s) Impacted

Vendor	Product	Versions
Piwigo	Piwigo	15.6.0, <15.7.0

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-640

Weak Password Recovery Mechanism for Forgotten Password

The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	piwigo	piwigo	15.6.0	/	/	/	/	/	/	/
a	piwigo	piwigo	<15.7.0	/	/	/	/	/	/	/

References

https://github.com/Piwigo/Piwigo/commit/9d2565465efc3570963ff431b45cad21610f6692

https://github.com/Piwigo/Piwigo/security/advisories/GHSA-9986-w7jf-33f6

CVSS Score

8.1 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: HIGH
Integrity Impact: HIGH
Availability Impact: NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

View Vector String

Timeline

Published: Nov. 18, 2025, 11:15 p.m.
Last Modified: Nov. 19, 2025, 7:14 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security-advisories@github.com

CVE-2025-62406