PT-2026-30243 · Piwigo · Piwigo

Acorzo1983 · CVE-2026-27834 · Published 2026-04-03 · Updated 2026-07-24

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 16.3.0

Description An issue exists in the pwg.users.getList Web Service API method where the filter parameter is directly concatenated into a SQL query without proper sanitization. This allows authenticated administrators to execute arbitrary SQL commands via SQL Injection, a technique used to interfere with the queries that an application makes to its database.

Recommendations Update to version 16.3.0. Avoid using the filter parameter in the pwg.users.getList API method until the update is applied.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-27834

GHSA-5JWG-CR5Q-VJQ2

Affected Products

Piwigo

References · 7

• 🔥 https://github.com/Piwigo/Piwigo/security/advisories/GHSA-5jwg-cr5q-vjq2 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27834.json · Exploit
• https://github.com/Piwigo/Piwigo/commit/9df471f16243371dc3725c5262e1632d23c8218a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27834 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27834 · Vendor Advisory
• https://t.me/cveNotify/222511 · Telegram Post
• https://piwigo.org/release-16.3.0 · Note