What is the CVSS score of CVE-2026-27834?

CVE-2026-27834 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Piwigo are affected by CVE-2026-27834?

Piwigo photo gallery versions prior to 16.3.0 contain a SQL injection vulnerability in the administrative API that allows authenticated admins to execute arbitrary database commands, potentially…. A patch is available.

How to fix or mitigate CVE-2026-27834?

Within 24 hours: inventory all Piwigo deployments and document current versions. Within 7 days: apply vendor-released patch version 16.3.0 to all affected instances. Within 30 days: audit administrative user accounts and API access logs for suspicious activity post-patch.

Piwigo CVE-2026-27834

EUVD-2026-18872 HIGH

SQL Injection (CWE-89)

2026-04-03 GitHub_M

SQLi Piwigo

7.2

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:06 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

16.3.0

EUVD ID Assigned

Apr 03, 2026 - 22:15 euvd

EUVD-2026-18872

Analysis Generated

Apr 03, 2026 - 22:15 vuln.today

CVE Published

Apr 03, 2026 - 21:35 nvd

HIGH 7.2

DescriptionCVE.org

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability exists in the pwg.users.getList Web Service API method. The filter parameter is directly concatenated into a SQL query without proper sanitization, allowing authenticated administrators to execute arbitrary SQL commands. This issue has been patched in version 16.3.0.

AnalysisAI

SQL injection in Piwigo photo gallery application allows authenticated administrators to execute arbitrary SQL commands via the pwg.users.getList Web Service API method. Piwigo versions prior to 16.3.0 are affected due to improper sanitization of the filter parameter, which is directly concatenated into database queries. Vendor-released patch version 16.3.0 addresses this vulnerability. EPSS data not provided; no public exploit identified at time of analysis. Authentication requirements (PR:H) significantly limit attack surface to users with administrative privileges.

Technical ContextAI

Piwigo is a PHP-based open source photo gallery application that provides Web Service API methods for administrative functions. This vulnerability stems from a classic CWE-89 SQL Injection flaw where user-controlled input from the filter parameter in the pwg.users.getList API endpoint is concatenated directly into SQL queries without parameterization or input validation. The affected component is the Web Service API layer that handles user enumeration and filtering operations. The CPE identifier cpe:2.3:a:piwigo:piwigo indicates this affects the core Piwigo application. SQL injection vulnerabilities of this class allow attackers to break out of the intended query context and inject arbitrary SQL commands, potentially accessing the entire database schema, modifying data, or executing stored procedures depending on database permissions and configuration.

RemediationAI

Vendor-released patch: version 16.3.0. Organizations running Piwigo should immediately upgrade to version 16.3.0 or later, which includes the security fix implemented in commit 9df471f16243371dc3725c5262e1632d23c8218a. The patch properly sanitizes the filter parameter in the pwg.users.getList API method to prevent SQL injection. Release notes and upgrade instructions are available at https://piwigo.org/release-16.3.0. As a temporary risk mitigation for environments where immediate patching is not feasible, organizations should audit administrator account access, implement additional authentication controls, review Web Service API access logs for suspicious filter parameters, and consider restricting network access to the Piwigo administrative interface using firewall rules or web application firewall policies. However, these workarounds do not eliminate the vulnerability and should only be considered temporary measures pending upgrade to the patched version.