Photoview
Monthly
Unauthenticated SQL injection in Photoview through 2.4.0 lets remote attackers read arbitrary data from the application database by manipulating the album_id path segment of the album download route. Because the pre-patch handler used the raw path value directly in a GORM lookup before any authentication or authorization check ran, any internet- or LAN-reachable instance is exploitable without credentials or user interaction, with impact limited to confidentiality (CVSS 4.0 base 8.7; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). A vendor fix has been merged upstream via pull request 1453; no public exploit code was identified at time of analysis, and the issue is not confirmed as actively exploited (CISA KEV).
Photoview through 2.4.0 contains an authorization bypass in the shareAlbum GraphQL mutation that lets any authenticated low-privileged user generate valid share tokens for albums owned by other users. Because album IDs are sequential integers, an attacker with a normal account can enumerate IDs and create working share links without needing any elevated privileges; distributing the resulting link exposes the victim's photos and sub-albums. Exploitation requires a multi-user deployment and an authenticated session, and no public exploit code has been identified at time of analysis, though the vendor has released an upstream fix.
Unauthenticated SQL injection in Photoview through 2.4.0 lets remote attackers read arbitrary data from the application database by manipulating the album_id path segment of the album download route. Because the pre-patch handler used the raw path value directly in a GORM lookup before any authentication or authorization check ran, any internet- or LAN-reachable instance is exploitable without credentials or user interaction, with impact limited to confidentiality (CVSS 4.0 base 8.7; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). A vendor fix has been merged upstream via pull request 1453; no public exploit code was identified at time of analysis, and the issue is not confirmed as actively exploited (CISA KEV).
Photoview through 2.4.0 contains an authorization bypass in the shareAlbum GraphQL mutation that lets any authenticated low-privileged user generate valid share tokens for albums owned by other users. Because album IDs are sequential integers, an attacker with a normal account can enumerate IDs and create working share links without needing any elevated privileges; distributing the resulting link exposes the victim's photos and sub-albums. Exploitation requires a multi-user deployment and an authenticated session, and no public exploit code has been identified at time of analysis, though the vendor has released an upstream fix.