CVE-2025-70364: RCE in Kiamo Photo Management Software

Successful exploitation of CVE-2025-70364 grants an attacker complete control over the server hosting the Kiamo instance. An authenticated administrator could execute arbitrary code, leading to data exfiltration, modification, or deletion of sensitive photo data and user information. The attacker could also leverage this access to move laterally within the network if the Kiamo server has access to other systems. The blast radius extends to any data stored and processed by the Kiamo application and any systems accessible from the compromised server.

1. Published2026-04-09
2. Modified2026-04-22
3. EPSS updated2026-04-17

The primary mitigation for CVE-2025-70364 is to upgrade Kiamo to version 8.4 or later, which includes restrictions on PHP functions that enable the arbitrary code execution. If upgrading is not immediately feasible, consider implementing strict access controls to limit the number of users with administrator privileges. Review and audit existing administrator accounts. While not a direct fix, a Web Application Firewall (WAF) configured to detect and block suspicious PHP code execution attempts could provide an additional layer of defense. After upgrading, verify the fix by attempting to execute a simple PHP command through the administrative interface; it should be blocked.