shouldiuse.io

Categories

VERDICT

Should I use Piwigo?

Open Source Photo Library and DAM Software - piwigo.org

Depends. Buy it if you can self-host and patch promptly — it's a proven, free, multi-user photo gallery trusted by councils and utilities. Skip it if you want zero-maintenance consumer backup or AI search; Immich or PhotoPrism fit better.

Confidence

Medium. Based on 25+ public sources: reviews, Reddit threads, official case studies, pricing pages, and CVE databases.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support qualityNo support evidence in sources
  • Security posture

Pricing

Free

Open Source (self-hosted)

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Hosted cloud plansPaid, 5 tiers

Best for

  • Self-hosters wanting a dependable gallery
  • Photographers sharing client galleries
  • Orgs needing a shared brand-asset library (DAM)
  • Multi-user teams controlling photo access

Not for

  • Casual users wanting Google Photos-style auto-backup
  • Anyone unwilling to patch security updates quickly
  • Non-technical buyers expecting budget turnkey hosting
  • Users wanting AI-heavy search — PhotoPrism or Immich fit better

Gotchas - check before you buy

high

Multiple 2025–2026 CVEs (SQLi, file read, RCE); patch to 16.4.0+ immediately

medium

Users question hosted pricing value versus the free self-hosted edition

medium

Steeper setup curve than Immich or Lychee; budget time for configuration

Pros and cons

Pros

  • Free, open-source core; G2 reviewers call it easy to use
  • Self-hosted community favorite: 'Piwigo does what you ask'
  • Proven at scale: utilities, county councils, universities run it
  • Large plugin ecosystem: video, watermarks, AI tagging
  • iOS and Android apps for uploads and browsing

Cons

  • More settings and configuration than Lychee or PhotoPrism
  • Recurring security holes: SQL injection, file read, RCE advisories
  • Some users say hosted plans only make sense if self-hosting
  • Self-hosting requires server, PHP, and database maintenance
  • Tiny team; free-tier support is community forums

Sources & method

Analyzed 10/02/2026 - 10 sources - Active risk: several 2025–2026 CVEs including SQL injection and arbitrary file read/RCE, fixed in v16.4.0 — patching discipline required.

official x3review x4security x3
  • SQL injection (CVE-2026-27634, CVE-2026-27834), Two SQL injection vulnerabilities disclosed April 2026.
  • Arbitrary file read (CVE-2026-85750), Affects Piwigo before v16.4.0.
  • File read and RCE via format confusion, July 2026 advisory describing arbitrary file read and RCE.
  • Information disclosure (CVE-2025-62512), Information disclosure flaw disclosed May 2026.

Key stats

  • Value for money: 5/5

    Rating

  • Free

    Starting price

  • 10

    Sources

  • Analyzed

  • Value for money: 5/5. Free core; G2 reviewers call it free and easy
  • Ease of use: 3/5. Users report more settings than rivals
  • Feature depth: 4/5. Multi-user, plugins, video, AI tagging
  • Support quality. No support evidence in sources
  • Security posture: 2/5. Multiple recent SQLi, file-read, RCE CVEs
  • Yes Free tier Open-source, self-host for free
  • 5 Paid tiers Hosted cloud plans
  • 4,130+ Live installs Websites tracked using Piwigo
  • $0 raised Funding Bootstrapped small French team

Pricing

Open Source (self-hosted)

Free

  • Unlimited photos on your server
  • Full plugin access
  • Community support

Hosted cloud plans

Paid, 5 tiers

  • Managed hosting and support
  • Tiers scale by users/storage

Security

Active risk: several 2025–2026 CVEs including SQL injection and arbitrary file read/RCE, fixed in v16.4.0 — patching discipline required.

  • SQL injection (CVE-2026-27634, CVE-2026-27834)Two SQL injection vulnerabilities disclosed April 2026.⁹
  • Arbitrary file read (CVE-2026-85750)Affects Piwigo before v16.4.0.⁷
  • File read and RCE via format confusionJuly 2026 advisory describing arbitrary file read and RCE.⁸
  • Information disclosure (CVE-2025-62512)Information disclosure flaw disclosed May 2026.

What users say

Self-hosters broadly praise Piwigo's reliability and price while noting it demands more configuration than newer rivals.

“Piwigo does what you ask.”
Reddit, r/selfhosted
“Piwigo is free and easy to use.”
G2 review

Companies that use it

  • Wessex Water10
  • ECT
  • Indre County Council
  • Icam (university network)
  • Cotentin Tourism Office
Full analysis

Based on 25+ public sources: reviews, Reddit threads, official case studies, pricing pages, and CVE databases.

Free open-source photo gallery that shines self-hosted — but patch it fast and expect fiddly setup. Casual users: just use Immich.

Methodology

Based on 25+ public sources: reviews, Reddit threads, official case studies, pricing pages, and CVE databases.

Sources

  1. Piwigo Reviews — G2g2.com
    review
  2. Piwigo, Lychee, PhotoPrism, LibrePhotos comparison — Reddit r/selfhostedreddit.com
    review
  3. Is Piwigo only worth it if you self-host? — Reddit r/Piwigoreddit.com
    review
  4. Piwigo is a Google Photos competitor worth considering — TechRadartechradar.com
    review
  5. Piwigo — official sitepiwigo.org
    official
  6. Piwigo Pricingpiwigo.org
    official
  7. CVE-2026-85750: Arbitrary file read — Rapid7rapid7.com
    security
  8. Arbitrary file read and RCE in Piwigo — HELXhelx.io
    security
  9. CVE-2026-27634: Piwigo SQLi — SentinelOnesentinelone.com
    security
  10. Wessex Water digital asset manager case studypiwigo.org
    official

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.