CVE-2025-62406 - CVE House
Back to Database
Status published High CVE-2025-62406

Piwigo is vulnerable to one-click account takeover by modifying the password-reset link

Vulnerability Description

Piwigo is a full featured open source photo gallery application for the web. In Piwigo 15.6.0, using the password reset function allows sending a password-reset URL by entering an existing username or email address. However, the hostname used to construct this URL is taken from the HTTP request's Host header and is not validated at all. Therefore, an attacker can send a password-reset URL with a modified hostname to an existing user whose username or email the attacker knows or guesses. This issue has been patched in version 15.7.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-62406

Credits & Attribution

No credits recorded in the NVD database.

References

More from Piwigo

View All →
CVE-2025-62512
Piwigo Vulnerable to User Enumeration via Password Reset Endpoint
Medium 5.5
CVE-2024-48928
Piwigo's secret key can be brute forced
Low 2.7
CVE-2023-44393
Piwigo Reflected XSS vulnerability
Critical 9.3
CVE-2023-37270
Piwigo SQL Injection vulnerability in "User-Agent"
High 7.6

Affected Vendor

Affected Software

Piwigo
Vulnerable Versions:
= 15.6.0

Timeline

Official Publish: November 18th, 2025
Last Modified: November 19th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-640

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.