File and Path Handling

Every one of the 4 is a mark on the map. Named now: 1 to 4, most at risk first.

1. Directory traversal vulnerability in install.php in Piwigo before 2.4.7 allows remote attackers to read and delete arbitrary files via a .. (dot dot) in the dl parameter.CVE-2013-1469Piwigo · 56% likely

   CWE-22

2. Directory traversal vulnerability in upgrade.php in Piwigo before 2.3.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language par…CVE-2012-2208Piwigo · 9.4% likely

   CWE-22

3. Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (full path) via an include/smarty/plugins/modifier.date_format.php request if PHP has a non-rec…CVE-2014-8939Piwigo · 1.4% likely

   CWE-22

4. Piwigo: Authenticated RCE via File Upload in Logo Upload FeatureCVE-2026-42322Piwigo · CVSS 9.1 · 1.3% likely

   CWE-434

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.