CVE-2026-27834: Piwigo: SQL Injection in pwg.users.getList API Method via filter Parameter
Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability exists in the pwg.users.getList Web Service API method. The filter parameter is directly concatenated into a SQL query without proper sanitization, allowing authenticated administrators to execute arbitrary SQL commands. This issue has been patched in version 16.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Piwigoto a version that resolves this vulnerability.Fixed in 16.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27834?
CVE-2026-27834 has a severity rating of high, with a score of 7.2.
How do I fix CVE-2026-27834?
To fix CVE-2026-27834, upgrade to Piwigo version 16.3.0 or later where the vulnerability is patched.
What type of vulnerability is CVE-2026-27834?
CVE-2026-27834 is a SQL Injection vulnerability affecting the pwg.users.getList API method.
Who is affected by CVE-2026-27834?
CVE-2026-27834 affects authenticated administrators using Piwigo versions prior to 16.3.0.
What component of Piwigo is impacted by CVE-2026-27834?
CVE-2026-27834 impacts the pwg.users.getList Web Service API method in Piwigo.