CVE-2026-44642: Piwigo: SQL injection in upgrade authentication allows unauthenticated upgrade authorization bypass (PHP 8+)
Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, checkupgradeaccessrights() in admin/include/functionsupgrade.php conditionally escapes the submitted username only when the removed getmagicquotesgpc function exists, so PHP 8 and later concatenate an unauthenticated username directly into the upgrade authentication SQL query. When database upgrades are pending, a crafted query result can satisfy the status and password checks, set PHPWGINUPGRADE, and authorize upgrade execution without valid administrator credentials. This can cause unauthorized database integrity changes and service disruption. This vulnerability is fixed in 16.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Piwigoto a version that resolves this vulnerability.Fixed in 16.4.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Piwigo versions prior to 16.4.0 are affected when running on PHP 8 or later and when database upgrades are pending. The vulnerable path is reachable without administrator credentials.
What does an attacker need to exploit this?
An attacker needs network access to the affected Piwigo instance and must submit a crafted username during upgrade authentication. Exploitation also depends on pending database upgrades being present.
Are normal installations affected by default?
The issue is conditional rather than affecting every request: database upgrades must be pending, and the application must run under PHP 8 or later. In that state, no valid administrator credentials are required for the described authorization bypass.
What is the remediation?
Upgrade Piwigo to version 16.4.0, which fixes the vulnerability. If immediate patching is not possible, prevent access to the upgrade workflow until the instance can be updated, particularly while database upgrades are pending.
How can I determine whether an instance is affected?
Check whether Piwigo is below 16.4.0, is running on PHP 8 or later, and has pending database upgrades. An instance meeting all of these conditions is exposed to the described upgrade-authentication bypass.