Which versions of Piwigo are affected by CVE-2026-27634?

Piwigo photo gallery versions prior to 16.3.0 contain an unauthenticated SQL injection vulnerability that allows attackers to extract entire databases including user credentials without…. A patch is available.

How to fix or mitigate CVE-2026-27634?

Within 24 hours: Identify all Piwigo instances and document current versions via administrative interface or version endpoint. Within 7 days: Upgrade all Piwigo installations to version 16.3.0 or later per vendor advisory. Within 30 days: Conduct password reset for all user accounts, scan logs for exploitation attempts (POST/GET requests with date filter parameters to ws_std_image_sql_filter or similar endpoints), and review database access logs for unusual queries.

Piwigo CVE-2026-27634

Q: What is the CVSS score of CVE-2026-27634?

CVE-2026-27634 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-18868 HIGH

SQL Injection (CWE-89)

2026-04-03 GitHub_M

SQLi Piwigo

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:06 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

16.3.0

EUVD ID Assigned

Apr 03, 2026 - 22:15 euvd

EUVD-2026-18868

Analysis Generated

Apr 03, 2026 - 22:15 vuln.today

CVE Published

Apr 03, 2026 - 21:33 nvd

HIGH 8.7

DescriptionCVE.org

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the four date filter parameters (f_min_date_available, f_max_date_available, f_min_date_created, f_max_date_created) in ws_std_image_sql_filter() are concatenated directly into SQL without any escaping or type validation. This could result in an unauthenticated attacker reading the full database, including user password hashes. This issue has been patched in version 16.3.0.

AnalysisAI

SQL injection in Piwigo photo gallery application versions prior to 16.3.0 allows unauthenticated remote attackers to extract the entire database, including user password hashes, via unsanitized date filter parameters in the ws_std_image_sql_filter() function. The vulnerability stems from direct SQL concatenation of four date parameters without input validation or escaping. Vendor-released patch available in version 16.3.0. EPSS and KEV data not provided, but the combination of unauthenticated access, low attack complexity, and full database disclosure represents critical risk for internet-facing Piwigo installations.

Technical ContextAI

Piwigo is an open-source web-based photo gallery management system written in PHP. The vulnerability exists in the ws_std_image_sql_filter() function, which processes date filtering parameters for image queries. Four parameters (f_min_date_available, f_max_date_available, f_min_date_created, f_max_date_created) are concatenated directly into SQL queries without parameterization, prepared statements, or type validation. This is a classic CWE-89 SQL Injection flaw where user-controlled input reaches database execution context without sanitization. The affected function appears to be part of the web services API layer, making it accessible to unauthenticated requestors. The CPE identifier cpe:2.3:a:piwigo:piwigo indicates the vulnerability affects the core Piwigo application across all versions prior to the patched release.

RemediationAI

Upgrade immediately to Piwigo version 16.3.0 or later, which contains the fix for this SQL injection vulnerability. The security patch is documented in commit 0d5ed1f7778bbe263410446d8cf64594df75bd08 available at https://github.com/Piwigo/Piwigo/commit/0d5ed1f7778bbe263410446d8cf64594df75bd08, and release details are published at https://piwigo.org/release-16.3.0. If immediate patching is not feasible, implement network-level access controls to restrict Piwigo web services to trusted IP ranges, though this is only a temporary mitigation and does not address the underlying code vulnerability. Verify the upgrade completed successfully and review database access logs for suspicious query patterns involving date filter parameters that may indicate prior exploitation attempts.