Improper Input Handling in Piwigo Installer Affects Database Configuration

CVE-2026-35048

What is CVE-2026-35048?

The Piwigo installer is affected by a vulnerability that allows an attacker to exploit unsanitized POST parameters meant for database configuration. In versions up to 16.3.0, these parameters (including dbpasswd, dbhost, dbname, dbuser, and prefix) are directly written to the PHP configuration file without adequate protection. This flaw is particularly concerning for users on PHP 8 and later, as it circumvents the existing addslashes() safeguard due to the removal of the get_magic_quotes_gpc() function. Consequently, an unauthenticated attacker may execute arbitrary PHP code, compromising the integrity and security of the web application.

References