CVE-2025-62406

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-62406
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-62406.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-62406
Aliases
  • GHSA-9986-w7jf-33f6
Published
2025-11-18T22:18:45Z
Modified
2026-08-12T03:51:11Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Piwigo is vulnerable to one-click account takeover by modifying the password-reset link
Details

Piwigo is a full featured open source photo gallery application for the web. In Piwigo 15.6.0, using the password reset function allows sending a password-reset URL by entering an existing username or email address. However, the hostname used to construct this URL is taken from the HTTP request's Host header and is not validated at all. Therefore, an attacker can send a password-reset URL with a modified hostname to an existing user whose username or email the attacker knows or guesses. This issue has been patched in version 15.7.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-640"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62406.json"
}
References

Affected packages

Git / github.com/piwigo/piwigo

Affected ranges

Type
GIT
Repo
https://github.com/piwigo/piwigo
Events
Introduced
52a3a3cc2f48b38440919ca50d74c11f5719b570
Fixed
9d2565465efc3570963ff431b45cad21610f6692
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:piwigo:piwigo:15.6.0:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "15.6.0"
        },
        {
            "last_affected": "15.6.0"
        }
    ],
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

15.*
15.6.0
= 15.*
= 15.6.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-62406.json"