Read the docs
TI-2026-07961 Aliases CVE-2026-9059GHSA-q977-85xc-w698

NextGEN Gallery - SQL Injection

Priority MEDIUM 42CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

NextGEN Gallery version prior to 4.2.1 are vulnerable to authenticated SQL injection via the 'orderby' parameter on the REST API endpoints '/imagely/v1/galleries' and '/imagely/v1/albums'. The root cause is an insufficient sanitization function ('_clean_column()') in the data mapper layer that uses a character blacklist instead of a whitelist approach. This allows an authenticated attacker with the 'NextGEN Gallery overview' capability (assigned to the Administrator role by default) to inject arbitrary SQL into the 'ORDER BY' clause.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00295 22nd percentileScored 2026-11-07
Fix Fixed NextGEN Gallery (awesomemotive): 4.2.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AwesomemotiveNextGEN GalleryO to before 4.2.14.2.1Patch availableCNA
  • NextGEN Gallery VendorAwesomemotive Affected O to before 4.2.1 Fixed in 4.2.1 Patch available CNA

Remediation

  • Fix · CNA NextGEN Gallery (awesomemotive) Fixed in 4.2.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-9059
  2. 2026-10-03 Alias added: GHSA-q977-85xc-w698

References

Other 1

  • TI-2020-09427 The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before… KEVCVSS 3.1HIGH 7.5
  • TI-2022-03313 Easy Digital Downloads < 3.1.0.2 - Unauthenticated CSV Injection CVSS 3.1CRITICAL 9.8
  • TI-2018-15322 Duplicator < 1.3.0 - Unauthenticated RCE CVSS 3.1CRITICAL 9.8
  • TI-2018-12305 An issue was discovered in Snap Creek Duplicator before 1.2.42. CVSS 3.1CRITICAL 9.8
  • TI-2023-05620 Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure CVSS 3.1HIGH 7.5
  • TI-2023-14647 WordPress Easy Digital Downloads Plugin 3.1-3.1.1.4.1 is vulnerable to Privilege Escalation CVSS 3.1CRITICAL 9.8
See all 71 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences