Piwigo CVE-2026-42324

Requires an authenticated Piwigo administrator account with access to the Batch Manager / element ranking feature (admin/element_set_ranks.php), consistent with PR:H. A concrete precondition stated in the advisory: at least one album must contain at least one photo, so that a later album or Batch Manager query (batch_manager_global.php, batch_manager_unit.php, section_init.inc.php, or ws_functions/pwg.categories.php) concatenates the stored image_order expression into an ORDER BY clause and triggers execution. The payload is stored and executes on a subsequent query rather than immediately. Exploitation is limited to Piwigo versions prior to 16.4.0 and is gated by administrator privileges, which materially bounds real-world risk.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H = 7.2 High) is internally consistent with the description: a network-reachable admin panel endpoint, low attack complexity, and no user interaction, but requiring high privileges (PR:H). The single most important limiting signal is PR:H - exploitation requires an authenticated administrator, who in Piwigo already legitimately controls gallery configuration, so this is primarily a privilege-boundary / defense-in-depth issue (config admin → arbitrary SQL) rather than a path to initial compromise. The full C:H/I:H/A:H triad is defensible because a stored SQL injection into ORDER BY clauses lets the attacker disclose, modify, or disrupt arbitrary database contents. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so there is no evidence of active or opportunistic exploitation - this reads as a real but low-urgency issue: genuinely exploitable, but gated behind admin access and confined to a niche self-hosted application. No signals conflict; the main caveat is that the practical impact of an already-admin attacker gaining SQL execution is bounded in single-tenant deployments but larger where the DB is shared or holds other applications' data.

An authenticated Piwigo administrator (or an attacker who has hijacked an admin session, e.g. via stolen credentials or CSRF) submits a crafted image_order[] value through admin/element_set_ranks.php, which is stored without the sort-field whitelist. When the gallery is next rendered or a Batch Manager query runs, the malicious expression is concatenated into an ORDER BY clause and executed, letting the attacker read, alter, or destroy database data. No public proof-of-concept is identified in the provided data.