CVE-2017-10680: Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack t...

Security readout for executives and security teams

This flaw lets an attacker trick a logged-in Piwigo user into sending a request that changes a private album to public. The business risk is unintended exposure of images or album content. The source bundle does not include CVSS, known exploitation, or complete affected package metadata beyond Piwigo through 2.9.1. Internet-facing or internal Piwigo installations at version 2.9.1 or earlier are the likely exposure, especially where administrators or content managers keep private albums. Prioritize remediation where Piwigo stores private, customer, employee, or sensitive image content. The issue is not rated critical from the supplied evidence, but unintended album publication can create confidentiality and reputational impact. Mitigation focus: Identify any Piwigo deployments and their exact versions.; Upgrade or patch using official Piwigo guidance and the referenced upstream fix.; Limit administrative access to trusted networks where practical..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.