Zenphoto — Vulnerabilities & Security Advisories 7

Zenphoto serves as a self-hosted gallery and content management system focused on media organization and display. Historically, it has been susceptible to multiple remote code execution vulnerabilities, cross-site scripting flaws, and privilege escalation issues, with seven CVEs documented. Security researchers have identified input validation weaknesses and improper access controls as recurring problems. While no major public security incidents have been widely reported, the consistent discovery of critical vulnerabilities highlights the importance of regular updates and hardening for deployments handling sensitive content. The application's open-source nature allows for community scrutiny but also exposes potential attack surfaces that require careful configuration.