New release 16.4.0 comes with 7 security issues fixed and 9 bugs also fixed.
Maybe because of recent AI tools, we have received (and continue to receive) several security advisories in the last weeks. Here are the first 7 security issues fixed. Special thanks to security reporters Jonathan from Helx.io, Leousum, sh4dowalker, maru1009, LipeOzyy and chakradhar1228.
Background image by MART PRODUCTION on Pexels
Have a good update!
Piwigo 16.4.0 release note
Offline
Thank you! :-)
Offline
For some reason, I still see an update notification when I log in to my Piwigo admin panel, but when I open the update page it says:
“Currently running version 16.2.0. You are running the latest version of Piwigo.”
So it looks like the notification may be stuck or cached (cleaned everything)
[Forum, topic 34818] Piwigo 16.2.0 shows update to 16.4.0 on Environment page, but Updates
Offline
thanks, I appreciate your concerns about security and the good maintenance of piwigo!!
after upgrading to 16.4 switching to PHP 8.5 i get the following error:
Deprecated: ord(): Providing a string that is not one byte long is deprecated. Use ord($str[0]) instead in /home/p-t6mte9/html/etienne-piwigo-fu381/include/functions_url.inc.php on line 262
after changing it to the suggested fix "Use ord($str[0])" everything seems to be fine again.
anybody else?
best,
etienne
Offline
There is a small error in the instructions for updating via docker. The line for the database dump should be
docker exec -it piwigo-db-1 mariadb-dump -u piwigodb_user -p"piwigodb" | tee db_dump.sql
as per the mariadb man page:
• --password[=password], -p[password]
The password to use when connecting to the server. If you use
the short option form (-p), you cannot have a space between
the option and the password. If you omit the password value
following the --password or -p option on the command line,
mariadb-dump prompts for one.
Specifying a password on the command line should be considered
insecure. You can use an option file to avoid giving the
password on the command line.
Was bashing my head against some walls before I found this :)
Offline
Updating docker image from v16.3.0 to v16.4.0 or v16.4.0a has an error in the log:
2026-05-05T14:43:11.247103495Z find: ‘/usr/local/bin/scripts/’: No such file or directory</pre>
Container startup seems to stop when this file is not found - no other entries in the log after this and site sending a 502 bad gateway error.
reverted to v16.3.0 and working fine, no errors.
Dave S wrote:
Updating docker image from v16.3.0 to v16.4.0 or v16.4.0a has an error in the log:
2026-05-05T14:43:11.247103495Z find: ‘/usr/local/bin/scripts/’: No such file or directory</pre>
Container startup seems to stop when this file is not found - no other entries in the log after this and site sending a 502 bad gateway error.
reverted to v16.3.0 and working fine, no errors.
I also got 502 bad gateway after updating but being a long time Linux user but first time server owner, i rebooted the server and after that it was working. Horribly low tech solution, sorry.
Offline
If someone knows the destination folder for the photos, they can see them. Doesn't Piwigo encrypt photos on the server, or am I just not able to enable it?
Hi,
That's a different topic. Please start a new thread.
Bramin wrote:
If someone knows the destination folder for the photos
If you go to a photo directory in your web browser, you'll be redirected to the Piwigo homepage
Offline
After update to 16.4.0 the database queries have increased a lot, 556% CPU.
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
1809 mysql 20 0 3221124 413404 26240 S 556.0 0.6 195:33.86 mariadbd
Is this expected? Will it be back to normal after a few days?
Last edited by mfgpi (Yesterday 20:08:09)
Offline