Piwigo · Piwigo · CVE-2016-10084
**Name of the Vulnerable Software and Affected Versions**
Piwigo versions prior to 2.8.4
**Description**
The issue allows remote authenticated administrators to conduct File Inclusion attacks. This is achieved via the `page['tab']` variable, also known as the mode parameter, in the admin/batch manager.php file.
**Recommendations**
For versions prior to 2.8.4, update to version 2.8.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin/batch manager.php file to minimize the risk of exploitation. Avoid using the `page['tab']` variable in the affected file until the issue is resolved.