•  » Announcements
  •  » Piwigo 16.4.0 : because security matters

#1 2026-05-03 16:52:53

plg
Piwigo Team
Nantes, France, Europe
2002-04-05
14057

Piwigo 16.4.0 : because security matters

New release 16.4.0 comes with 7 security issues fixed and 9 bugs also fixed.

Maybe because of recent AI tools, we have received (and continue to receive) several security advisories in the last weeks. Here are the first 7 security issues fixed. Special thanks to security reporters Jonathan from Helx.io, Leousum, sh4dowalker, maru1009, LipeOzyy and chakradhar1228.

https://sandbox.piwigo.com/i?/uploads/4/y/1/4y1zzhnrnw//2024/07/09/20240709142318-a8fc498d-la.jpg
Background image by MART PRODUCTION on Pexels

Have a good update!

Piwigo 16.4.0 release note

Offline

#2 2026-05-03 22:13:49

dummer-esel
Member
2017-01-25
73

Re: Piwigo 16.4.0 : because security matters

Thank you! :-)

Offline

#3 2026-05-04 00:51:18

jessica1998
Member
New York (USA)
2022-05-09
31

Re: Piwigo 16.4.0 : because security matters

For some reason, I still see an update notification when I log in to my Piwigo admin panel, but when I open the update page it says:

“Currently running version 16.2.0. You are running the latest version of Piwigo.”

So it looks like the notification may be stuck or cached (cleaned everything)

[Forum, topic 34818] Piwigo 16.2.0 shows update to 16.4.0 on Environment page, but Updates

Offline

#4 2026-05-04 15:38:43

EtienneG
Member
2021-10-15
6

Re: Piwigo 16.4.0 : because security matters

thanks, I appreciate your concerns about security and the good maintenance of piwigo!!

after upgrading to 16.4 switching to PHP 8.5 i get the following error:

Deprecated: ord(): Providing a string that is not one byte long is deprecated. Use ord($str[0]) instead in /home/p-t6mte9/html/etienne-piwigo-fu381/include/functions_url.inc.php on line 262

after changing it to the suggested fix "Use ord($str[0])" everything seems to be fine again.

anybody else?

best,
etienne

Offline

#5 2026-05-05 09:35:40

pump_up_the_jam
Member
2026-05-05
2

Re: Piwigo 16.4.0 : because security matters

There is a small error in the instructions for updating via docker. The line for the database dump should be

Code:

docker exec -it piwigo-db-1 mariadb-dump -u piwigodb_user -p"piwigodb" | tee db_dump.sql

as per the mariadb man page:

•    --password[=password], -p[password]

           The password to use when connecting to the server. If you use
           the short option form (-p), you cannot have a space between
           the option and the password. If you omit the password value
           following the --password or -p option on the command line,
           mariadb-dump prompts for one.

           Specifying a password on the command line should be considered
           insecure. You can use an option file to avoid giving the
           password on the command line.

Was bashing my head against some walls before I found this :)

Offline

#6 2026-05-05 16:56:28

Dave S
Guest

Re: Piwigo 16.4.0 : because security matters

Updating docker image from v16.3.0 to v16.4.0 or v16.4.0a has an error in the log:

2026-05-05T14:43:11.247103495Z find: ‘/usr/local/bin/scripts/’: No such file or directory</pre>

Container startup seems to stop when this file is not found - no other entries in the log after this and site sending a 502 bad gateway error. 

reverted to v16.3.0 and working fine, no errors.

#7 2026-05-05 18:55:57

pump_up_the_jam
Member
2026-05-05
2

Re: Piwigo 16.4.0 : because security matters

Dave S wrote:

Updating docker image from v16.3.0 to v16.4.0 or v16.4.0a has an error in the log:

2026-05-05T14:43:11.247103495Z find: ‘/usr/local/bin/scripts/’: No such file or directory</pre>

Container startup seems to stop when this file is not found - no other entries in the log after this and site sending a 502 bad gateway error. 

reverted to v16.3.0 and working fine, no errors.

I also got 502 bad gateway after updating but being a long time Linux user but first time server owner, i rebooted the server and after that it was working. Horribly low tech solution, sorry.

Offline

#8 2026-05-09 23:07:06

Bramin
Guest

Re: Piwigo 16.4.0 : because security matters

If someone knows the destination folder for the photos, they can see them. Doesn't Piwigo encrypt photos on the server, or am I just not able to enable it?

#9 Yesterday 08:24:40

ddtddt
Piwigo Team
Quetigny - France
2007-07-27
7333

Re: Piwigo 16.4.0 : because security matters

Hi,

That's a different topic. Please start a new thread.


Bramin wrote:

If someone knows the destination folder for the photos

If you go to a photo directory in your web browser, you'll be redirected to the Piwigo homepage


You love Piwigo so don't hesitate to participate, learn more on the "Contribute to Piwigo" page. If you don't have much time for contribution, you can also help the project with a donation.

Offline

#10 Yesterday 19:56:47

mfgpi
Member
2021-11-05
8

Re: Piwigo 16.4.0 : because security matters

After update to 16.4.0 the database queries have increased a lot, 556% CPU.

PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND
1809 mysql     20   0 3221124 413404  26240 S 556.0   0.6          195:33.86 mariadbd

Is this expected? Will it be back to normal after a few days?

Last edited by mfgpi (Yesterday 20:08:09)

Offline

  •  » Announcements
  •  » Piwigo 16.4.0 : because security matters

Board footer

Powered by FluxBB