CVE-2025-62512

Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the password reset functionality in Piwigo allows an unauthenticated attacker to determine whether a given username or email address exists in the system. The endpoint at password.php?action=lost returns distinct messages for valid vs. invalid accounts, enabling user enumeration. As of time of publication, no known patches are available.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/Piwigo/Piwigo/security/advisories/GHSA-h4wx-7m83-xfxc	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*

History

17 Jun 2026, 09:52

Type	Values Removed	Values Added
Summary		(es) Piwigo es una aplicación de galería de fotos de código abierto para la web. En la versión 15.5.0 y probablemente en versiones 15.x anteriores, la funcionalidad de restablecimiento de contraseña en Piwigo permite a un atacante no autenticado determinar si un nombre de usuario o una dirección de correo electrónico dados existen en el sistema. El endpoint en password.PHP?action=lost devuelve mensajes distintos para cuentas válidas frente a inválidas, lo que permite la enumeración de usuarios. Hasta el momento de la publicación, no hay parches conocidos disponibles.

25 Feb 2026, 16:53

Type	Values Removed	Values Added
CPE		cpe:2.3:a:piwigo:piwigo::::::::
First Time		Piwigo Piwigo piwigo
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.3
References	~~() https://github.com/Piwigo/Piwigo/security/advisories/GHSA-h4wx-7m83-xfxc -~~	() https://github.com/Piwigo/Piwigo/security/advisories/GHSA-h4wx-7m83-xfxc - Exploit, Mitigation, Vendor Advisory

24 Feb 2026, 18:29

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-02-24 18:29

Updated : 2026-06-17 09:52

NVD link : CVE-2025-62512

Mitre link : CVE-2025-62512

CVE.ORG link : CVE-2025-62512

JSON object : View

Products Affected

piwigo

piwigo

CWE

CWE-204

Observable Response Discrepancy

{"id": "CVE-2025-62512", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62512", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-27T20:52:21.821693Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Piwigo", "product": "Piwigo", "versions": [{"status": "affected", "version": "= 15.5.0"}]}]}], "published": "2026-02-24T18:29:32.930", "references": [{"url": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-h4wx-7m83-xfxc", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-204"}]}], "descriptions": [{"lang": "en", "value": "Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the password reset functionality in Piwigo allows an unauthenticated attacker to determine whether a given username or email address exists in the system. The endpoint at password.php?action=lost returns distinct messages for valid vs. invalid accounts, enabling user enumeration. As of time of publication, no known patches are available."}, {"lang": "es", "value": "Piwigo es una aplicaci\u00f3n de galer\u00eda de fotos de c\u00f3digo abierto para la web. En la versi\u00f3n 15.5.0 y probablemente en versiones 15.x anteriores, la funcionalidad de restablecimiento de contrase\u00f1a en Piwigo permite a un atacante no autenticado determinar si un nombre de usuario o una direcci\u00f3n de correo electr\u00f3nico dados existen en el sistema. El endpoint en password.PHP?action=lost devuelve mensajes distintos para cuentas v\u00e1lidas frente a inv\u00e1lidas, lo que permite la enumeraci\u00f3n de usuarios. Hasta el momento de la publicaci\u00f3n, no hay parches conocidos disponibles."}], "lastModified": "2026-06-17T09:52:00.887", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FAD8BA0E-AD85-45CE-8DEC-D0DA08E28FFA", "versionEndIncluding": "15.5.0", "versionStartIncluding": "15.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}