CVE-2016-10105: admin/plugin.php in Piwigo through 2.8.3 doesn't validate the sections variable while using it to include f...

Security readout for executives and security teams

Piwigo through 2.8.3 had a flaw in its admin plugin page where user-controlled section selection was used to include files without proper validation. That could expose sensitive files or lead to code execution in vulnerable deployments. Public sources do not provide CVSS scoring or confirmed exploitation. Exposure is limited to Piwigo deployments through 2.8.3 where the administrative plugin endpoint is present and reachable to authenticated or otherwise permitted users. The bundle does not prove broader product impact beyond Piwigo or clarify authentication requirements. Prioritize remediation for internet-accessible or business-critical Piwigo sites. Treat this as high urgency where admin interfaces are exposed, because the stated impact includes possible code execution, but plan validation carefully because public scoring and exploitation evidence are incomplete. Mitigation focus: Identify all Piwigo instances and their deployed versions.; Upgrade Piwigo using official vendor guidance for this issue.; Confirm fixes corresponding to the cited upstream commits are present..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.