SQL Injection Vulnerability in Piwigo Photo Gallery Application
CVE-2026-27634

8.7HIGH

Key Information:

Vendor

Piwigo

Status
Piwigo
Vendor
CVE Published:
3 April 2026

What is CVE-2026-27634?

Piwigo, an open-source photo gallery application, has a vulnerability affecting versions prior to 16.3.0. Four date filter parameters were improperly handled in the ws_std_image_sql_filter() function, allowing an unauthenticated attacker to execute SQL injection attacks. This lack of proper input validation and escaping could potentially expose sensitive database information, including user password hashes. The vulnerability was addressed in version 16.3.0, where necessary security improvements were implemented.

Affected Version(s)

Piwigo < 16.3.0

References

https://github.com/Piwigo/Piwigo/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/Piwigo/Piwigo/commit/0d5ed1f7778bbe263...
x_refsource_MISC
https://piwigo.org/release-16.3.0
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.