Piwigo EUVD-2026-87135

Requires an authenticated Piwigo administrator account (PR:H) and access to the admin/batch_manager.php Batch Manager. The specific trigger is the URL-based filter parser (as opposed to the validated POST filter path): supplying crafted dimension width/height/ratio or filesize values in the filter URL, which are stored in the bulk_manager_filter session state and later concatenated into SQL predicates without numeric validation. Exploitation is limited to Piwigo versions prior to 16.4.0 and to actors who already hold administrator privileges, which is the primary factor constraining real-world risk to insider abuse, credential theft, or admin-session hijacking.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (base 7.2, High) is internally consistent with the description: a network-reachable admin endpoint (admin/batch_manager.php) with low attack complexity and no user interaction, but requiring high privileges (PR:H - an authenticated administrator). This is a genuine CWE-89 SQL injection, confirmed by the vendor GHSA advisory and the fix commits, which add filter_var()/FILTER_VALIDATE_INT/FILTER_VALIDATE_FLOAT numeric validation to the previously-unvalidated width/height/ratio/filesize URL filter values before they reach SQL predicate concatenation. The critical mitigating signal is PR:H: the attacker must already hold Piwigo administrator rights, a role that legitimately controls much of the application and database content, so the marginal privilege gain is limited to direct arbitrary SQL execution beyond the app's intended query surface. No EPSS score, no CISA KEV listing, and no public POC were supplied, so exploitation is: no public exploit identified at time of analysis. Overall this is a real, well-documented flaw but a moderate operational priority rather than an urgent one - the admin-only precondition sharply narrows the realistic threat to insider misuse, compromised admin credentials, or chaining from an admin-session CSRF/XSS. No signals conflict; the main caveat is that C:H/I:H/A:H somewhat overstates net impact given the attacker is already a trusted admin.

An attacker who has obtained Piwigo administrator access (via stolen/weak credentials or a hijacked admin session) opens the Batch Manager and crafts a filter URL with malicious dimension or filesize values (e.g. width/height/ratio/filesize segments containing SQL). The parser stores the values into the bulk_manager_filter session state and later concatenates them into SQL predicates, enabling time-based blind or in-band injection to read, alter, or destroy database data. No public exploit code is currently identified, and attack complexity is low once admin access exists.