SQL Injection in Piwigo Photo Gallery Application by Piwigo
CVE-2026-44642
What is CVE-2026-44642?
Piwigo, an open-source photo gallery application, contains an SQL injection vulnerability. Prior to version 16.4.0, a flaw in the check_upgrade_access_rights() function allows unauthenticated users to inject crafted SQL queries during database upgrades. This occurs because the application conditionally escapes the submitted username only under specific conditions, particularly when the deprecated get_magic_quotes_gpc function is present. In PHP 8 and later, the lack of proper sanitation can enable attackers to execute an unauthorized upgrade process. This could result in unauthorized modification of database integrity and potential service disruptions. The vulnerability has been patched in version 16.4.0, underscoring the importance of keeping the software updated.
Affected Version(s)
Piwigo < 16.4.0