CVE-2026-62262 Details

A critical SQL injection vulnerability has been identified in Piwigo versions through 17.0.0beta1. The issue arises in the 'pwg.images.filteredSearch.create' function, where an unauthenticated guest can manipulate the 'ratings[]' parameter to inject SQL. This exploitation occurs because the application fails to properly validate the input before using it in SQL queries. The vulnerability allows for error-based or blind SQL injection, enabling attackers to extract database information or cause time-based delays through the public search interface.

As of now, there is no fixed version available. However, the vulnerability can be addressed by validating the 'ratings[]' parameter before it is stored in the search rules, ensuring that only values from the configured rating list are accepted. Additionally, the SQL query builder should avoid using raw filter values, instead deriving both bounds from validated integers.