CVE-2021-31783

HIGH

Piwigo Localfiles Editor < 11.4.0.1 - Data Authenticity Bypass

Title source: rule
STIX 2.1

Description

show_default.php in the LocalFilesEditor extension before 11.4.0.1 for Piwigo allows Local File Inclusion because the file parameter is not validated with a proper regular-expression check.

References (3)

Core 3
Core References
Release Notes, Third Party Advisory x_refsource_misc
https://piwigo.org/ext/index.php?cid=null
Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/Piwigo/LocalFilesEditor/issues/2

Scores

CVSS v3 7.5
EPSS 0.0018
EPSS Percentile 38.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-345
Status published
Products (1)
piwigo/localfiles_editor < 11.4.0.1
Published Apr 26, 2021
Tracked Since Feb 18, 2026