CVE-2026-27834

HIGH SEVERITY

CVSS Score & Metrics

Base Score

7.2 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H                                    

Vulnerability Description

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability exists in the pwg.users.getList Web Service API method. The filter parameter is directly concatenated into a SQL query without proper sanitization, allowing authenticated administrators to execute arbitrary SQL commands. This issue has been patched in version 16.3.0.

Vulnerability Details

Published Date

April 03, 2026

Last Modified

April 09, 2026

CWE ID

CWE-89

Source

NVD

Vendor

Piwigo

Product

Piwigo

External References

https://github.com/Piwigo/Piwigo/commit/9df471f16243371dc3725c5262e1632d23c8218a
https://github.com/Piwigo/Piwigo/security/advisories/GHSA-5jwg-cr5q-vjq2
https://piwigo.org/release-16.3.0

CVE-2026-27834

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment