CVE-2017-10681: Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack t...

Security readout for executives and security teams

Piwigo installations through 2.9.1 could let an attacker trick a logged-in user into sending an album-unlock request. The impact depends on who is targeted and what albums are locked. This is not evidence of server takeover, but it can undermine access controls for private gallery content. Organizations running Piwigo through 2.9.1 are the relevant exposure. Risk is highest where authenticated users can unlock sensitive albums and can be lured to attacker-controlled content. Prioritize if Piwigo protects private or client-facing media. This is likely not a critical infrastructure emergency, but it can weaken confidentiality controls and should be remediated during normal vulnerability management. Mitigation focus: Inventory Piwigo deployments and identify any versions through 2.9.1.; Review Piwigo vendor guidance and release notes for the fix containing the referenced commit.; Upgrade affected Piwigo instances when vendor guidance confirms the corrected release..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.