CVE-2026-35048: Piwigo RCE via PHP Code Injection into Config File in Installer
The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization. On PHP 8+, the addslashes() protection is bypassed because it checks for getmagicquotesgpc(), a function removed in PHP 8.0. This allows raw user input to be interpolated directly into PHP source code. An unauthenticated attacker can inject arbitrary PHP code through POST parameters (prefix, dbpasswd, dbhost, dbname, or dbuser), which gets written to local/config/database.inc.php and executed on every page load.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Piwigoto a version that resolves this vulnerability.Fixed in 16.3.0 - Configuration
Update the installer/config-writing logic so POST parameters (prefix, dbpasswd, dbhost, dbname, dbuser) are not written directly into local/config/database.inc.php as raw PHP code.
Piwigo installer (database config handling) POST parameters (prefix, dbpasswd, dbhost, dbname, dbuser) sanitization before writing local/config/database.inc.php = Ensure raw POST values are not interpolated into PHP source code (add proper sanitization/validation) - Configuration
Remove/replace the addslashes()-based protection that depends on get_magic_quotes_gpc(), since it is removed in PHP 8.0; ensure equivalent sanitization is applied for PHP 8+.
PHP addslashes() usage get_magic_quotes_gpc() dependency = Do not rely on get_magic_quotes_gpc() for addslashes() protection
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35048?
CVE-2026-35048 has a critical severity score of 9.8.
How do I fix CVE-2026-35048?
To fix CVE-2026-35048, upgrade to Piwigo version 16.3.1 or later, which addresses the PHP code injection vulnerability.
What is the impact of CVE-2026-35048?
CVE-2026-35048 allows remote code execution via PHP code injection into the configuration file during installation.
Which versions of Piwigo are affected by CVE-2026-35048?
Piwigo versions 16.3.0 and earlier are affected by CVE-2026-35048.
What type of vulnerability is CVE-2026-35048?
CVE-2026-35048 is classified as an input validation vulnerability due to insufficient sanitization of user inputs.