CVE-2026-27634

CRITICAL SEVERITY

CVSS Score & Metrics

Base Score

9.8 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H                                    

Vulnerability Description

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the four date filter parameters (f_min_date_available, f_max_date_available, f_min_date_created, f_max_date_created) in ws_std_image_sql_filter() are concatenated directly into SQL without any escaping or type validation. This could result in an unauthenticated attacker reading the full database, including user password hashes. This issue has been patched in version 16.3.0.

Vulnerability Details

Published Date

April 03, 2026

Last Modified

April 09, 2026

CWE ID

CWE-89

Source

NVD

Vendor

Piwigo

Product

Piwigo

External References

https://github.com/Piwigo/Piwigo/commit/0d5ed1f7778bbe263410446d8cf64594df75bd08
https://github.com/Piwigo/Piwigo/security/advisories/GHSA-mgqc-3445-qghq
https://piwigo.org/release-16.3.0

CVE-2026-27634

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment