Photo Prism Security & Risk Analysis

The PhotoPrism plugin presents a mixed security posture. On the positive side, it has no recorded vulnerabilities or CVEs, suggesting a history of responsible development or at least a lack of public exploitation. The use of prepared statements for the majority of SQL queries and a single file operation are also good indicators. However, significant concerns arise from the static analysis. The plugin exposes two AJAX handlers, both of which lack authentication checks, creating a substantial attack surface for unauthorized actions. Furthermore, three taint analysis flows were found with unsanitized paths, indicating a high risk of path traversal vulnerabilities. While the plugin exhibits some good practices, the lack of authentication on critical entry points and the presence of unsanitized path flows are serious security weaknesses that require immediate attention.