EUVD-2026-46006Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network RCE with full C/I/A impact; base score keeps AC:L, though the installer-must-be-reachable precondition is a real-world limiter better captured as an attack requirement in 4.0.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization. On PHP 8+, the addslashes() protection is bypassed because it checks for get_magic_quotes_gpc(), a function removed in PHP 8.0. This allows raw user input to be interpolated directly into PHP source code. An unauthenticated attacker can inject arbitrary PHP code through POST parameters (prefix, dbpasswd, dbhost, dbname, or dbuser), which gets written to local/config/database.inc.php and executed on every page load.
Articles & Coverage 1
AnalysisAI
Remote code execution in Piwigo 16.3.0 and earlier lets an unauthenticated attacker inject arbitrary PHP through the web installer, which writes unsanitized POST parameters (prefix, dbpasswd, dbhost, dbname, dbuser) into local/config/database.inc.php where they execute on every page load. The bug is a PHP 8 regression: the addslashes() guard is gated on get_magic_quotes_gpc(), removed in PHP 8.0, so escaping is silently skipped and raw input reaches PHP source. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the Piwigo installer/setup flow be network-reachable and that the target run PHP 8.0 or newer (the missing get_magic_quotes_gpc() is what disables escaping) - this is the exact precondition, not a generic one. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) frames this as network-reachable, unauthenticated, low-complexity full-impact RCE, which is accurate WHEN the installer is exposed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker discovers a freshly deployed or partially provisioned Piwigo instance whose installer is still reachable, and submits a crafted POST to the database-configuration step with a PHP payload embedded in a field such as dbname or dbhost. Because addslashes() is skipped on PHP 8, the payload is written verbatim into database.inc.php and executes on the next page load, giving the attacker code execution as the web server user. … |
| Remediation | Upgrade to the fixed Piwigo release identified in advisory GHSA-gphq-34pv-gvf3 (https://github.com/Piwigo/Piwigo/security/advisories/GHSA-gphq-34pv-gvf3); the exact fixed version number is not stated in the provided data, so consult the advisory or the project releases page and install the first version above 16.3.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Piwigo installations and determine if the web installer is reachable; if the system is fully configured, move or remove the installer directory (typically /install) and verify it returns 404. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today