PT-2026-21769 · Piwigo · Piwigo

Published 2026-02-24 · Updated 2026-02-25 · CVE-2024-48928

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Piwigo versions 14.x

Description Piwigo is a photo gallery application for the web. In versions on the 14.x branch, the secret key configuration parameter is set to MD5(RAND()) during installation when using MySQL. The RAND() function has limited randomness (30 bits), allowing the secret key to be brute-forced in approximately one hour. The CSRF token is partially constructed from the secret key, enabling verification of a successful brute-force attempt. The auto login key utilizes the user's password in addition to the secret key, and the pwg token incorporates the user's session identifier along with the secret key. Knowing the secret key allows the generation of values for get ephemeral key.

Recommendations Update to version 15.0.0 or later.

Exploit

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2024-48928

GHSA-HGHG-37RG-7R42

Affected Products

Piwigo

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/48xxx/CVE-2024-48928.json · Exploit
• https://github.com/Piwigo/Piwigo/security/advisories/GHSA-hghg-37rg-7r42 · Vendor Advisory
• https://github.com/Piwigo/Piwigo/commit/552499e0533ce54b55f4304b41ca6cd7ccce51f8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-48928 · Security Note
• https://osv.dev/vulnerability/CVE-2024-48928 · Vendor Advisory
• https://twitter.com/CVEnew/status/2026676446564139111 · Twitter Post
• https://t.me/CVEtracker/45630 · Telegram Post