SQL Injection Vulnerability in Piwigo Photo Gallery Application
CVE-2026-27634

8.7HIGH

Key Information:

Vendor: Piwigo
Status: Piwigo
Vendor: CVE Published:; 3 April 2026

What is CVE-2026-27634?

Piwigo, an open-source photo gallery application, has a vulnerability affecting versions prior to 16.3.0. Four date filter parameters were improperly handled in the ws_std_image_sql_filter() function, allowing an unauthenticated attacker to execute SQL injection attacks. This lack of proper input validation and escaping could potentially expose sensitive database information, including user password hashes. The vulnerability was addressed in version 16.3.0, where necessary security improvements were implemented.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch