What is the CVSS score of CVE-2026-35048?

CVE-2026-35048 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Piwigo are affected by CVE-2026-35048?

Piwigo versions 16.3.0 and earlier contain a critical remote code execution vulnerability in the web installer that allows unauthenticated attackers to execute arbitrary PHP code and achieve full…

How to fix or mitigate CVE-2026-35048?

Within 24 hours, inventory all Piwigo installations and determine if the web installer is reachable; if the system is fully configured, move or remove the installer directory (typically /install) and verify it returns 404. If the installer must remain available, immediately restrict network access via firewall, reverse proxy, or authentication gateway until a patch is released. Within 7 days, subscribe to Piwigo's security advisory channels, monitor for patch releases, and prepare deployment procedures for rapid rollout. Within 30 days, apply the vendor-released patch to all affected instances as soon as it becomes available and verify successful remediation through vulnerability scanning.

Piwigo CVE-2026-35048

EUVD-2026-46006 CRITICAL

Improper Input Validation (CWE-20)

2026-07-20 GitHub_M

PHP RCE Piwigo

9.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network RCE with full C/I/A impact; base score keeps AC:L, though the installer-must-be-reachable precondition is a real-world limiter better captured as an attack requirement in 4.0.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:55 vuln.today

CVE Published

Jul 20, 2026 - 16:27 cve.org

CRITICAL 9.8

DescriptionCVE.org

The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization. On PHP 8+, the addslashes() protection is bypassed because it checks for get_magic_quotes_gpc(), a function removed in PHP 8.0. This allows raw user input to be interpolated directly into PHP source code. An unauthenticated attacker can inject arbitrary PHP code through POST parameters (prefix, dbpasswd, dbhost, dbname, or dbuser), which gets written to local/config/database.inc.php and executed on every page load.

Articles & Coverage 1

News Critical RCE in Piwigo 16.3.0 via PHP Web Installer Config Injection - CVE-2026-35048 Jul 20, 2026

AnalysisAI

Remote code execution in Piwigo 16.3.0 and earlier lets an unauthenticated attacker inject arbitrary PHP through the web installer, which writes unsanitized POST parameters (prefix, dbpasswd, dbhost, dbname, dbuser) into local/config/database.inc.php where they execute on every page load. The bug is a PHP 8 regression: the addslashes() guard is gated on get_magic_quotes_gpc(), removed in PHP 8.0, so escaping is silently skipped and raw input reaches PHP source. No public exploit identified at time of analysis, but the flaw is trivially weaponizable when the installer is reachable, yielding full server compromise.

Technical ContextAI

Piwigo is an open-source, self-hosted PHP photo gallery application. The vulnerable component is its first-run web installer, which collects database connection settings and persists them by string-interpolating user input into a generated PHP file (local/config/database.inc.php). Root cause maps to CWE-20 (Improper Input Validation), specifically improper neutralization of input written into a code file: the legacy defense addslashes() is only invoked behind a get_magic_quotes_gpc() check, and because that function was removed in PHP 8.0 the branch never runs, allowing quote-breaking and PHP delimiters (e.g. closing a string literal or opening <?php) to be embedded verbatim. Because the config file is include()'d on every request, injected code becomes persistent server-side execution. The CPE cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:* confirms the Piwigo application itself as the affected product across versions up to and including 16.3.0.

RemediationAI

Upgrade to the fixed Piwigo release identified in advisory GHSA-gphq-34pv-gvf3 (https://github.com/Piwigo/Piwigo/security/advisories/GHSA-gphq-34pv-gvf3); the exact fixed version number is not stated in the provided data, so consult the advisory or the project releases page and install the first version above 16.3.0. As immediate compensating controls: block or restrict network access to the installer path (the install/setup endpoints) at the web server or firewall so it is not reachable from untrusted networks - trade-off is none for already-installed sites but this blocks legitimate re-runs of setup; delete or rename the installer files after successful installation, which is standard hardening with no downside for a configured instance; and after any suspected exposure, inspect local/config/database.inc.php for injected PHP and rebuild from a known-good source, since the file executes on every request. Restricting who can reach the setup flow (VPN/IP allowlist during provisioning) mitigates the setup-window exposure at the cost of slightly more complex initial deployment.