CVE-2012-2208

CVE-2012-2208 is a directory traversal vulnerability affecting Piwigo versions prior to 2.3.4, specifically within the upgrade.php script. An unauthenticated remote attacker can exploit this by manipulating the 'language' parameter with dot-dot-slash sequences to include and execute arbitrary local files. With a CVSS score of 7.5, this vulnerability is considered highly severe, allowing for potential compromise of confidentiality, integrity, and availability of the affected system. While not listed on the KEV catalog, exploit code is publicly available on ExploitDB, though there is no evidence of active exploitation or significant community discussion.