CVE-2025-62406
highpriority · track · 35EPSS 0.004 · 37 %ileEUUSEPSS · scored 2026-10-28
Piwigo is a full featured open source photo gallery application for the web. In Piwigo 15.6.0, using the password reset function allows sending a password-reset URL by entering an existing username or email address. However, the hostname used to construct this URL is taken from the HTTP request's Host header and is not validated at all. Therefore, an attacker can send a password-reset URL with a modified hostname to an existing user whose username or email the attacker knows or guesses. This issue has been patched in version 15.7.0.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
also known as (2)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2025-62406cnnvd
- https://github.com/Piwigo/Piwigo/commit/9d2565465efc3570963ff431b45cad21610f6692cnnvd
- https://github.com/Piwigo/Piwigo/security/advisories/GHSA-9986-w7jf-33f6cnnvd
- https://piwigo.org/get-piwigoPatchcnnvd
- https://github.com/Piwigo/Piwigo/commit/9d2565465efc3570963ff431b45cad21610f6692enisa_euvd
- https://github.com/Piwigo/Piwigo/security/advisories/GHSA-9986-w7jf-33f6enisa_euvd
- https://github.com/Piwigo/Piwigo/commit/9d2565465efc3570963ff431b45cad21610f6692Patchnvd
- https://github.com/Piwigo/Piwigo/security/advisories/GHSA-9986-w7jf-33f6ExploitVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan