We recently received a security report on Github by Takumi Katanoda concerning the possibility to target a Piwigo user to reset his/her password. We do not consider it as an "easy" attack but with his advice we have strengthen the security on the form to reset password. We have also made "less verbose" the reset password message to avoid revealing potentially interesting information to attackers, it was another security advisory reported by mateusz.stroba.

Thank you very much for your reports that help us to make Piwigo more secure.


Background image by Steve Johnson on Pexels

Piwigo 15.7.0 release note