CVE-2026-9059: NextGEN Gallery - SQL Injection
NextGEN Gallery version prior to 4.2.1 are vulnerable to authenticated SQL injection via the 'orderby' parameter on the REST API endpoints '/imagely/v1/galleries' and '/imagely/v1/albums'.
The root cause is an insufficient sanitization function ('cleancolumn()') in the data mapper layer that uses a character blacklist instead of a whitelist approach. This allows an authenticated attacker with the 'NextGEN Gallery overview' capability (assigned to the Administrator role by default) to inject arbitrary SQL into the 'ORDER BY' clause.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NextGEN Galleryto a version that resolves this vulnerability.Fixed in 4.2.1 - Compensating control
Restrict the 'NextGEN Gallery overview' capability (assigned to the Administrator role by default) so only trusted users can access the REST API endpoints that expose the vulnerable 'orderby' parameter ('/imagely/v1/galleries' and '/imagely/v1/albums').
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9059?
CVE-2026-9059 has been classified as a high severity vulnerability due to its potential for authenticated SQL injection.
How do I fix CVE-2026-9059?
To remediate CVE-2026-9059, upgrade NextGEN Gallery to version 4.2.1 or higher to ensure proper sanitization of the 'orderby' parameter.
What software is affected by CVE-2026-9059?
CVE-2026-9059 affects Imagely NextGEN Gallery versions prior to 4.2.1.
What are the vulnerable endpoints in CVE-2026-9059?
The vulnerable endpoints in CVE-2026-9059 are the REST API endpoints '/imagely/v1/galleries' and '/imagely/v1/albums'.
What is the root cause of CVE-2026-9059?
The root cause of CVE-2026-9059 is an insufficient sanitization function called '_clean_column()'.