CVE-2026-44642 Details
Description
Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, check_upgrade_access_rights() in admin/include/functions_upgrade.php conditionally escapes the submitted username only when the removed get_magic_quotes_gpc function exists, so PHP 8 and later concatenate an unauthenticated username directly into the upgrade authentication SQL query. When database upgrades are pending, a crafted query result can satisfy the status and password checks, set PHPWG_IN_UPGRADE, and authorize upgrade execution without valid administrator credentials. This can cause unauthorized database integrity changes and service disruption. This vulnerability is fixed in 16.4.0.
A SQL injection vulnerability has been identified in Piwigo, an open-source photo gallery application, in versions prior to 16.4.0. The issue arises in the 'check_upgrade_access_rights()' function within 'admin/include/functions_upgrade.php'. Here, the submitted username is only conditionally escaped based on the presence of the 'get_magic_quotes_gpc' function. In PHP 8 and later, this function is unavailable, allowing an unauthenticated username to be directly concatenated into the SQL query for upgrade authentication. When there are pending database upgrades, a crafted query result can bypass authentication checks and authorize upgrade execution without valid administrator credentials. This could lead to unauthorized changes in database integrity and cause service disruptions.
Users can upgrade to Piwigo version 16.4.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 25, 2026CISA-ADP
Assessed Sep 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Piwigo/Piwigo/security/advisories/GHSA-6wj3-7fhw-gfpm | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Piwigo/Piwigo/commit/1ff9d04534feb5f8f3cc2d3613c0fe8b51a1c0ba | [email protected] | Source CodeVendor |
| https://github.com/Piwigo/Piwigo/commit/2cfa7a3d194c8b95edde43038d8f5be5a359e785 | [email protected] | Source CodeVendor |
| https://github.com/Piwigo/Piwigo/releases/tag/16.4.0 | [email protected] | Vendor |
| https://github.com/Piwigo/Piwigo/security/advisories/GHSA-6wj3-7fhw-gfpm | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Piwigo | <= 17.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | CVE Modified | CISA-ADP |
| Sep 25, 2026 | New CVE Received | [email protected] |