[ CVE-2026-42323 · Published 25 Sep 2026 ]
Vulnerability in Piwigo
[ Why it matters ]Priority signals
- Public proof-of-concept exploit exists (CISA SSVC)
[ Description ]Official description
Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/batch_manager.php accepts administrator-controlled dimension width, height, and ratio values and filesize values from the Batch Manager filter URL without numeric validation. The URL filter parser stores those values in the bulk_manager_filter session state, and later query construction concatenates them into SQL predicates, unlike the validated POST filter path. An authenticated administrator can use crafted filter values to execute time-based or other SQL expressions and potentially disclose, modify, or disrupt database data. This issue is fixed in version 16.4.0.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.