SQL Injection Vulnerability in Piwigo Photo Gallery Application

CVE-2026-42324

What is CVE-2026-42324?

A vulnerability has been identified in the Piwigo Photo Gallery application, where prior to version 16.4.0, the admin/element_set_ranks.php component allows an authenticated administrator to insert unsanitized input into the image ordering process. This manipulation can lead to the execution of arbitrary database queries, potentially exposing or altering sensitive data. The risk is heightened when albums contain photos, as attackers could leverage crafted input through various admin functionalities to disrupt database interactions. The issue has been effectively resolved in version 16.4.0, and users are urged to upgrade to this latest version to ensure their systems remain secure.

References