Photoview CVE-2026-96673

No special conditions - remote unauthenticated exploitation against default configurations of Photoview through 2.4.0, targeting the album download route by manipulating the album_id path segment. The pre-patch handler performed no type or bounds validation before using the value in a GORM query, so any internet- or LAN-reachable instance is exploitable without credentials or user interaction. The only limiting factor is network reachability of the Photoview API; the product's typical self-hosted, single-user/home-lab deployment (rather than any authentication or non-default setting) is what constrains real-world exposure.

The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) reflects a genuinely serious, low-friction issue: an unauthenticated, network-reachable SQL injection in Photoview's album download route requiring no user interaction and no special conditions against a default install. The source-code evidence corroborates the description - the pre-patch handler passed the raw album_id path segment directly into db.Find(&album, albumID), so the attack surface is real and confirmed by the vendor patch (PR #1453). Impact is scoped to confidentiality only (VC:H, VI:N, VA:N): the vector, the description's mention of blind/time-based extraction, and the GORM SELECT context all consistently point to data theft rather than modification or DoS. No EPSS score, CISA KEV entry, or formal exploit-code flag was provided, so widespread automated exploitation is not confirmed; however, a public technical writeup (hackmd) plus a VulnCheck advisory materially lower the barrier to weaponization. This is a real priority for anyone running Photoview exposed to untrusted networks - not a high-CVSS-but-low-risk paper finding - though its overall real-world blast radius is bounded by the product's niche, self-hosted deployment footprint rather than by exploitation difficulty.

An unauthenticated attacker sends a GET request to the album download route (e.g. /api/download/album/<album_id>/...) substituting the numeric album_id with a crafted SQL payload such as a time-based AND SLEEP(1) condition. Because the ID was concatenated into a GORM query without validation, the attacker uses blind/time-based inference to extract arbitrary database contents (user records, credentials hashes, private album data). A public technical writeup on hackmd and a VulnCheck advisory describe the injection, so practical exploitation details are already available even though no packaged exploit-code flag is present.