Security readout for executives and security teams
Plain-English summary
Piwigo 11.5.0 has a reported stored cross-site scripting issue in the admin batch manager single-image mode. If malicious content is saved and later viewed by an administrator, browser-side code could run in that trusted session. Public evidence does not provide a CVSS score, fixed version, or active-exploitation claim.
Executive priority
Handle as a near-term web application remediation item for any internet-facing or externally managed Piwigo instance. It is not supported as an emergency KEV-style issue by the provided sources, but stored XSS in admin workflows can create meaningful account and content-integrity risk.
Technical view
The CVE describes persistent XSS through /admin.php?page=batch_manager&mode=unit in Piwigo 11.5.0. The available bundle does not specify the vulnerable parameter, CWE, patch level, or exploit prerequisites beyond the admin batch-manager single mode context. Treat impact as administrative-session browser compromise risk until vendor details are confirmed.
Likely exposure
Exposure appears limited to Piwigo 11.5.0 instances where the admin batch manager single mode is reachable and processes attacker-influenced stored content. The provided affected-product metadata is incomplete, so version scoping should be verified against Piwigo guidance.
Exploitation context
The source bundle does not show CISA KEV listing or any cited evidence of active exploitation. Stored XSS usually requires malicious content to be saved and then rendered to a victim user, here apparently in an administrative Piwigo workflow.
Researcher notes
Evidence is thin: the CVE text names Piwigo 11.5.0 and an admin route, but does not include CVSS, CWE, parameter details, fixed version, or exploit status. Avoid broad version claims until the GitHub issue or vendor release notes confirm scope.
Mitigation direction
- Inventory Piwigo deployments and identify any running version 11.5.0.
- Check the Piwigo issue and vendor guidance for the fixed release.
- Upgrade or patch only according to confirmed vendor instructions.
- Restrict Piwigo admin access to trusted, authenticated users.
- Review stored gallery metadata/content for suspicious script-like input.
Validation and detection
- Confirm whether /admin.php?page=batch_manager&mode=unit exists on deployed Piwigo instances.
- Verify deployed Piwigo version against vendor guidance for issue 1476.
- Review admin access logs for unusual batch-manager activity.
- Test remediation in staging using safe XSS validation strings only.
- Confirm stored content renders encoded, not executable, after remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-40678 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/Piwigo/Piwigo/issues/1476CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.