CVE-2026-42323: Piwigo: SQL Injection in Batch Manager
Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/batchmanager.php accepts administrator-controlled dimension width, height, and ratio values and filesize values from the Batch Manager filter URL without numeric validation. The URL filter parser stores those values in the bulkmanagerfilter session state, and later query construction concatenates them into SQL predicates, unlike the validated POST filter path. An authenticated administrator can use crafted filter values to execute time-based or other SQL expressions and potentially disclose, modify, or disrupt database data. This issue is fixed in version 16.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Piwigoto a version that resolves this vulnerability.Fixed in 16.4.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Piwigo administrator can exploit it by supplying crafted Batch Manager filter values through the URL. The affected inputs include dimension width, height, ratio, and filesize values.
Are installations using the normal POST-based Batch Manager filters affected?
The issue is in the URL filter parsing path, which does not apply numeric validation before values are used in SQL predicates. The POST filter path is described as validated.
What versions need remediation?
Piwigo versions prior to 16.4.0 are affected. Upgrade to version 16.4.0 to obtain the fix.
What could exploitation allow?
A crafted filter can cause SQL expressions to be executed, including time-based expressions. An attacker with administrator access could potentially disclose, modify, or disrupt database data.