CVE-2026-27634: Piwigo: Pre-auth SQL injection via date filter parameters in ws_std_image_sql_filter
Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the four date filter parameters (fmindateavailable, fmaxdateavailable, fmindatecreated, fmaxdatecreated) in wsstdimagesqlfilter() are concatenated directly into SQL without any escaping or type validation. This could result in an unauthenticated attacker reading the full database, including user password hashes. This issue has been patched in version 16.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Piwigoto a version that resolves this vulnerability.Fixed in 16.3.0 - Compensating control
Apply the update promptly and ensure the vulnerable endpoint ws_std_image_sql_filter is not reachable from untrusted networks until patched.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27634?
CVE-2026-27634 has a high severity rating of 8.7 on the CVSS scale.
What does CVE-2026-27634 affect?
CVE-2026-27634 affects Piwigo, an open-source photo gallery application for the web.
How do I fix CVE-2026-27634?
To fix CVE-2026-27634, you should update to Piwigo version 16.3.0 or later, where the vulnerability is patched.
What type of vulnerability is CVE-2026-27634?
CVE-2026-27634 is classified as an SQL injection vulnerability.
What are the potential risks associated with CVE-2026-27634?
The risks associated with CVE-2026-27634 include unauthorized access to the database and potential data manipulation.