CVE-2026-62262: Piwigo: Unauthenticated SQL injection in `pwg.images.filteredSearch.create`
Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings[] value and then open the returned search URL. include/wsfunctions/pwg.images.php stores the unvalidated value in the search rules, and include/functionssearch.inc.php integer-casts only the lower rating bound while concatenating the raw value as the SQL upper bound. This allows error-based or blind extraction of database information and database-dependent time delays through the public search flow. No fixed version is available as of this review.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Piwigo instances that have ratings enabled are exposed through the public search flow. The attack can be performed by an unauthenticated guest, so no account or administrative access is required.
What does an attacker need to do to exploit it?
An attacker needs to submit a crafted ratings[] value to pwg.images.filteredSearch.create and then open the returned search URL. The vulnerable handling occurs when the raw value is incorporated as the upper rating bound in the SQL query.
Are installations affected by default?
The issue is conditional on ratings being enabled. The provided information does not establish whether ratings are enabled by default.
What can be done if a fixed version is not available?
Disable ratings to remove the stated prerequisite for exploitation. No fixed version was available at the time of review.
How can defenders assess potential impact?
Review whether ratings are enabled and whether unauthenticated requests to pwg.images.filteredSearch.create are reachable. Requests containing unexpected or malformed ratings[] values followed by access to returned search URLs may indicate attempted exploitation.