Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability exists in the pwg.users.getList Web Service API method. The filter parameter is directly concatenated into a SQL query without proper sanitization, allowing authenticated administrators to execute arbitrary SQL commands. This issue has been patched in version 16.3.0.
References
| Link | Resource |
|---|---|
| https://github.com/Piwigo/Piwigo/commit/9df471f16243371dc3725c5262e1632d23c8218a | Patch |
| https://github.com/Piwigo/Piwigo/security/advisories/GHSA-5jwg-cr5q-vjq2 | Exploit Mitigation Vendor Advisory |
| https://piwigo.org/release-16.3.0 | Release Notes |
| https://github.com/Piwigo/Piwigo/security/advisories/GHSA-5jwg-cr5q-vjq2 | Exploit Mitigation Vendor Advisory |
Configurations
History
09 Apr 2026, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/Piwigo/Piwigo/commit/9df471f16243371dc3725c5262e1632d23c8218a - Patch | |
| References | () https://github.com/Piwigo/Piwigo/security/advisories/GHSA-5jwg-cr5q-vjq2 - Exploit, Mitigation, Vendor Advisory | |
| References | () https://piwigo.org/release-16.3.0 - Release Notes | |
| CPE | cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:* | |
| First Time |
Piwigo
Piwigo piwigo |
06 Apr 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/Piwigo/Piwigo/security/advisories/GHSA-5jwg-cr5q-vjq2 - |
03 Apr 2026, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-03 22:16
Updated : 2026-04-09 21:15
NVD link : CVE-2026-27834
Mitre link : CVE-2026-27834
CVE.ORG link : CVE-2026-27834
JSON object : View
Products Affected
piwigo
- piwigo
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')