Piwigo EUVD-2026-87136

Exploitation requires the Piwigo rating feature to be ENABLED (the vulnerable rating-bound filter clause is only built when rating is enabled) and the pwg.images.filteredSearch.create web API endpoint to be reachable by anonymous guests - both true in typical public gallery deployments. No authentication (PR:N), no user interaction (UI:N), and no non-default client configuration are needed beyond ratings being on. The attack targets Piwigo 17.0.0beta1 and all earlier versions. The primary limiting factor is that galleries with ratings disabled are not exploitable, and that as of this review no fixed version has been shipped so patched binaries are not yet distributable (mitigation is disabling ratings or applying the upstream commits).

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, base 9.1 Critical) describes a network-reachable, unauthenticated, low-complexity SQL injection requiring no user interaction - a genuinely dangerous combination. The technical detail supports the network/unauthenticated claims: an anonymous guest calls the pwg.images.filteredSearch.create web API and then opens the returned search URL. I assess the I:H component as overstated: the flaw lives in the upper-bound concatenation of a rating value inside a SELECT WHERE clause (rating_score < <raw>), which enables error-based, blind, and time-based extraction of database contents - a confidentiality/read primitive, not a demonstrated write/integrity primitive. No EPSS score, no CISA KEV listing, and no public POC are provided, so despite the high CVSS this is not confirmed to be under active or widespread exploitation. However, the vendor fix commits are public (GHSA-hq29-8hhx-5jwc), which lowers the bar for an attacker to reverse-engineer the vulnerable code path. One important limiting condition tempers the raw score: exploitation only works 'when rating is enabled,' so environments with the rating feature off are not affected. Net: a real, prioritize-and-patch-when-available issue for exposed Piwigo instances with ratings enabled, but not yet a confirmed mass-exploitation event.

An unauthenticated attacker who can reach a public Piwigo gallery (17.0.0beta1 or earlier) with the rating feature enabled sends a pwg.images.filteredSearch.create request containing a crafted ratings[] value; the raw value is stored in the search rules and concatenated as the SQL upper rating bound. The attacker then opens the returned search URL to trigger the query, using error-based or time-based responses to extract database contents such as user credentials and session data. No public exploit code is identified at time of analysis, but the fix commits are public and the attack requires no authentication or user interaction.