CVE-2013-1468: Cross-site request forgery (CSRF) vulnerability in the LocalFiles Editor plugin in Piwigo before 2.4.7 allo...

Security readout for executives and security teams

CVE-2013-1468 affects Piwigo before 2.4.7 through the LocalFiles Editor plugin. A malicious site could abuse an authenticated administrator’s browser to make privileged changes, reportedly including creating PHP files. That makes exposure most serious for internet-facing galleries with active administrators using vulnerable versions. Likely exposure is limited to Piwigo deployments before 2.4.7 with the LocalFiles Editor plugin present or enabled. Risk depends on an administrator being authenticated and induced to trigger attacker-controlled requests. Prioritize remediation for any public or business-critical Piwigo site still below 2.4.7. The business risk is administrator action forgery leading to server-side PHP file creation, but evidence for active exploitation is not provided. Mitigation focus: Upgrade affected Piwigo installations to 2.4.7 or later vendor-supported versions.; Review Piwigo’s 2.4.7 release notes and vendor issue references.; Disable or restrict LocalFiles Editor until confirmed fixed, where operationally feasible..

Prepared

Jun 24, 2026, 11:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.