SQL Injection Vulnerability in Piwigo Gallery Application

CVE-2026-62262

What is CVE-2026-62262?

Piwigo, a popular open-source photo gallery application, allows an unauthenticated guest to exploit a vulnerability in versions 17.0.0beta1 and earlier. When the rating feature is enabled, an attacker can send a maliciously crafted ratings[] parameter to the function pwg.images.filteredSearch.create. This unvalidated input is processed to define search rules and can lead to SQL injection through improper handling of the rating values, allowing for error-based extraction of sensitive database information. This occurs when the raw input is concatenated into SQL queries without adequate validation, potentially exposing site data through public search interfaces.

References