Piwigo CVE-2026-44642

Two concrete prerequisites must both hold: (1) the Piwigo instance runs on PHP 8.0 or later, where the get_magic_quotes_gpc function no longer exists so the conditional addslashes escaping in check_upgrade_access_rights() is skipped; and (2) the instance is in a pending-database-upgrade state, making the upgrade authentication path reachable. The attacker must also craft a SQL-injected username whose query result satisfies both the status and password checks to set PHPWG_IN_UPGRADE. Limiting factors: exploitation is only possible during the transient upgrade-pending window (typically right after code is updated but before the DB migration runs), which is why CVSS assigns AC:H; no authentication or user interaction is required (PR:N/UI:N). Affected: all Piwigo versions prior to 16.4.0.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1) frames this as a network-reachable, unauthenticated SQL injection with high impact, but AC:H is the honest and decisive signal: exploitation is gated on a specific transient state - the Piwigo instance must have pending database upgrades so the install/upgrade authentication path in check_upgrade_access_rights() is reachable, and the attacker must craft a query result that satisfies both the status and password checks to set PHPWG_IN_UPGRADE. The root cause is real and clean: the escaping of the submitted username was conditioned on the get_magic_quotes_gpc function, which was removed in PHP 8, so on any PHP 8+ deployment the username is concatenated directly into the auth SQL query (CWE-89). There is no EPSS score, no CISA KEV listing, and no public exploit in the provided intelligence, so this is 'no public exploit identified at time of analysis' - not confirmed exploitation. Net: a genuine unauthenticated auth-bypass/SQLi that deserves patching, but the pending-upgrade window and the PHP-8+ condition make it opportunistic and time-bounded rather than a broadly wormable mass-exploitation target. The 8.1 rating is defensible on impact but the practical real-world risk is moderated by the narrow trigger window.

An attacker who discovers a Piwigo site running on PHP 8+ that has been code-updated but not yet database-migrated (upgrade pending) sends crafted input to the upgrade authentication endpoint, injecting SQL into the username that is concatenated unescaped into the auth query. By shaping the query result to satisfy the status and password checks, the attacker sets PHPWG_IN_UPGRADE and authorizes upgrade execution without valid administrator credentials, leading to unauthorized database changes and service disruption. No public proof-of-concept is referenced in the available data.