CVE-2026-42323 Details
Description
Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/batch_manager.php accepts administrator-controlled dimension width, height, and ratio values and filesize values from the Batch Manager filter URL without numeric validation. The URL filter parser stores those values in the bulk_manager_filter session state, and later query construction concatenates them into SQL predicates, unlike the validated POST filter path. An authenticated administrator can use crafted filter values to execute time-based or other SQL expressions and potentially disclose, modify, or disrupt database data. This issue is fixed in version 16.4.0.
A time-based blind SQL injection vulnerability has been identified in Piwigo Photo Gallery application versions prior to 16.4.0. The issue resides in the Batch Manager's URL filter parsing, specifically within the 'dimension' and 'filesize' parameters. These parameters are accepted without proper numeric validation, allowing an authenticated administrator to inject SQL payloads that could be executed later, potentially leading to unauthorized database access or manipulation.
Users are advised to update to Piwigo version 16.4.0, where this vulnerability has been patched. The update is available on the Piwigo official website.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Piwigo/Piwigo/commit/c7e30da5c1775b531ce9a30aac04134cd714b472 | [email protected] | Source CodeVendor |
| https://github.com/Piwigo/Piwigo/commit/e4f0989d350d66207066ea61f8ee8c137164fb2f | [email protected] | Source CodeVendor |
| https://github.com/Piwigo/Piwigo/releases/tag/16.4.0 | [email protected] | Vendor |
| https://github.com/Piwigo/Piwigo/security/advisories/GHSA-7r67-9xhq-7p2c | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Piwigo | 16.2 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | New CVE Received | [email protected] |