CVE-2017-10679: Piwigo through 2.9.1 allows remote attackers to obtain sensitive information about the descriptive name of...

Security readout for executives and security teams

This issue can let an unauthenticated remote party learn the descriptive name behind a private Piwigo album permalink. It does not indicate full album access, but album names can reveal sensitive project, client, event, or internal information. Exposure is most relevant for internet-facing Piwigo deployments running version 2.9.1 or earlier, especially where private albums use meaningful permalink names. Systems without private albums or descriptive permalinks likely have lower impact. Prioritize remediation for public Piwigo galleries containing sensitive client, event, investigation, or internal album names. Business impact is mainly confidentiality and reconnaissance, with no evidence here of direct data extraction or active exploitation. Mitigation focus: Inventory Piwigo deployments and identify versions at or below 2.9.1.; Check Piwigo vendor guidance and release notes for the fixed version.; Upgrade affected Piwigo installations when a vendor-supported fix is confirmed..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.