CVE-2026-96673: Photoview through 2.4.0 SQL Injection via album download route
Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the albumid path segment. Attackers can supply crafted SQL expressions in the albumid parameter to extract arbitrary data from the database using time-based or blind injection techniques.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
Any unauthenticated remote attacker who can reach the Photoview album download route can attempt exploitation. No privileges or user interaction are required.
What does an attacker need to control?
The attacker needs to manipulate the album_id path segment in a request to the album download route. Crafted SQL expressions can be used for time-based or blind injection techniques.
What is the potential impact?
An attacker may extract arbitrary data from the Photoview database. The available information describes confidentiality impact and does not indicate integrity or availability impact.
Which versions are known to be affected?
Photoview through version 2.4.0 is affected.