PT-2026-61634 · Piwigo · Piwigo

CVE-2026-35048 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 16.3.1

Description The installer fails to properly sanitize POST parameters used for database configuration before writing them to a PHP configuration file. On PHP 8+, the protection mechanism is bypassed due to the removal of the get magic quotes gpc() function, allowing raw user input to be interpolated into PHP source code. An unauthenticated attacker can inject arbitrary PHP code via the prefix, dbpasswd, dbhost, dbname, or dbuser parameters, which is then written to the local/config/database.inc.php file and executed on every page load.

Recommendations Update to version 16.3.1 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-35048

GHSA-GPHQ-34PV-GVF3

Affected Products

Piwigo

References · 4

• 🔥 https://github.com/Piwigo/Piwigo/security/advisories/GHSA-gphq-34pv-gvf3 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35048.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-35048 · Security Note
• https://osv.dev/vulnerability/CVE-2026-35048 · Vendor Advisory