What is the CVSS score of CVE-2026-27885?

CVE-2026-27885 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Piwigo are affected by CVE-2026-27885?

Piwigo versions prior to 16.3.0 contain a SQL injection vulnerability in the Activity List API that allows authenticated administrators to extract sensitive database contents, including user…. A patch is available.

How to fix or mitigate CVE-2026-27885?

Within 24 hours: Identify all Piwigo instances in your environment and document current versions. Within 7 days: Upgrade all Piwigo installations to version 16.3.0 or later. Within 30 days: Audit administrative activity logs in Piwigo for suspicious API access patterns and verify that only authorized administrators retain access.

Piwigo CVE-2026-27885

EUVD-2026-18874 HIGH

SQL Injection (CWE-89)

2026-04-03 GitHub_M

SQLi Information Disclosure Piwigo

7.2

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:06 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

16.3.0

EUVD ID Assigned

Apr 03, 2026 - 22:15 euvd

EUVD-2026-18874

Analysis Generated

Apr 03, 2026 - 22:15 vuln.today

CVE Published

Apr 03, 2026 - 21:36 nvd

HIGH 7.2

DescriptionCVE.org

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability was discovered in Piwigo affecting the Activity List API endpoint. This vulnerability allows an authenticated administrator to extract sensitive data from the database, including user credentials, email addresses, and all stored content. This issue has been patched in version 16.3.0.

AnalysisAI

SQL injection in Piwigo's Activity List API endpoint allows authenticated administrators to extract sensitive database contents including user credentials and email addresses. This vulnerability affects Piwigo versions prior to 16.3.0 and requires high-level privileges (administrator access) to exploit. CVSS score of 7.2 reflects the network-accessible attack vector with low complexity, though exploitation requires prior administrative authentication. No public exploit code or active exploitation (CISA KEV) identified at time of analysis. The vendor has released version 16.3.0 addressing this issue.

Technical ContextAI

This vulnerability represents a classic SQL injection flaw (CWE-89) in Piwigo, an open-source PHP-based photo gallery web application. The vulnerability exists specifically in the Activity List API endpoint, where insufficient input sanitization or parameterized query usage allows malicious SQL commands to be injected into database queries. SQL injection vulnerabilities occur when user-controllable input is concatenated directly into SQL statements rather than being properly escaped or parameterized. In this case, an authenticated administrator can craft malicious SQL payloads that manipulate the intended database query logic, allowing extraction of arbitrary data from the Piwigo database schema. The affected product (cpe:2.3:a:piwigo:piwigo) is a content management system storing user authentication data, photo metadata, and gallery configuration in its backend database, making the confidentiality impact particularly severe.

RemediationAI

Upgrade immediately to Piwigo version 16.3.0 or later, which contains the vendor-released patch addressing this SQL injection vulnerability. The specific remediation commit is documented at https://github.com/Piwigo/Piwigo/commit/c172d284e11eab4a5dbadd2844d26f734d5c8c72, providing code-level transparency into the fix implementation. Organizations should apply this upgrade through their standard patch management processes, ensuring all Piwigo instances are updated. As an interim risk reduction measure pending upgrade, administrators should audit and restrict administrative account access to only essential personnel, implement strong authentication controls for admin accounts, and monitor database query logs for suspicious Activity List API requests containing SQL metacharacters or unusual query patterns. No workaround exists that fully mitigates the vulnerability without upgrading. Complete release notes and upgrade instructions are available at https://piwigo.org/release-16.3.0.