Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function.
on `file` param. No worry with an admin, but this method can be used by a community user as well.

Originally reported by Zak S. see CVE-2020-9467
stored XSS with pwg.images.setInfo
This is a GitHub Issue
repo:Piwigo
owner:Piwigo
Title : stored XSS with pwg.images.setInfo
Issue date:

--- start body ---
on `file` param. No worry with an admin, but this method can be used by a community user as well.

Originally reported by Zak S. see CVE-2020-9467
--- end body ---

The issue describes a stored Cross-Site Scripting (XSS) vulnerability in the `pwg.images.setInfo` method of Piwigo. This vulnerability allows community users to inject malicious scripts through the `file` parameter, which can be executed in the context of other users' browsers, potentially leading to session hijacking or other malicious actions. The reference to CVE-2020-9467 indicates that this is a known vulnerability that has been previously reported.