CVE-2017-9425: The Facetag extension 0.0.3 for Piwigo allows XSS via the name parameter to ws.php in a facetag.changeTag a...

Security readout for executives and security teams

CVE-2017-9425 is a stored cross-site scripting issue in the Facetag 0.0.3 extension for Piwigo. An attacker who can change a tag name may cause script content to be stored and later run in a user’s browser. Business impact depends on who can use the affected action and who views the resulting content. Exposure is likely limited to Piwigo sites that installed the Facetag extension version 0.0.3. Risk is higher if untrusted or low-privilege users can invoke tag changes, or if privileged users later view affected stored tag content. Prioritize if Piwigo is internet-facing, Facetag 0.0.3 is installed, or untrusted users can edit tags. Otherwise, handle through normal vulnerability management with verification because public exploit references exist but active exploitation is not evidenced here. Mitigation focus: Inventory Piwigo deployments for the Facetag extension and version 0.0.3.; Disable or remove Facetag where it is not business-critical.; Check Piwigo or Facetag maintainer guidance for a fixed version or official mitigation..

Prepared

Jun 7, 2026, 14:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.