CVE-2026-42324: Piwigo: Second-Order SQL Injection
Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/elementsetranks.php stores administrator-controlled imageorder[] values without enforcing the existing sort-field whitelist. The stored album imageorder expression is later concatenated into ORDER BY clauses by admin/batchmanagerglobal.php, admin/batchmanagerunit.php, include/sectioninit.inc.php, and include/wsfunctions/pwg.categories.php. When at least one album contains at least one photo, an authenticated administrator can store a crafted expression and trigger it in a later album or Batch Manager query to disclose, modify, or disrupt database data. This issue is fixed in version 16.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Piwigoto a version that resolves this vulnerability.Fixed in 16.4.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Piwigo administrator can exploit it. Exploitation also requires that at least one album contains at least one photo.
What does an attacker need to do to trigger the injection?
The attacker must store a crafted value in an album's image_order[] setting through admin/element_set_ranks.php. The stored expression is triggered later when it is used in an album or Batch Manager query.
Are installations affected by default?
The issue is reachable through administrator-controlled image ordering values, so an attacker needs administrative access rather than unauthenticated access. Affected deployments are those running versions prior to 16.4.0 with an album containing at least one photo.
What is the remediation?
Upgrade Piwigo to version 16.4.0, which fixes the issue. If upgrading cannot happen immediately, restrict administrator access to trusted users and avoid setting untrusted image ordering values.
How can I determine whether a system may be affected?
Check whether the Piwigo version is earlier than 16.4.0. Also review album image ordering configuration for unexpected or crafted image_order[] expressions, particularly where administrators have used ranking or ordering controls.