Read the docs
TI-2026-32542 Aliases CVE-2026-44642

Piwigo: SQL injection in upgrade authentication allows unauthenticated upgrade authorization bypass (PHP 8+)

Priority HIGH 70CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, check_upgrade_access_rights() in admin/include/functions_upgrade.php conditionally escapes the submitted username only when the removed get_magic_quotes_gpc function exists, so PHP 8 and later concatenate an unauthenticated username directly into the upgrade authentication SQL query. When database upgrades are pending, a crafted query result can satisfy the status and password checks, set PHPWG_IN_UPGRADE, and authorize upgrade execution without valid administrator credentials. This can cause unauthorized database integrity changes and service disruption. This vulnerability is fixed in 16.4.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01285 70th percentileScored 2026-11-07
Fix Fixed Piwigo (Piwigo): 16.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PiwigoPiwigobefore 16.4.016.4.0Patch availableCNA
  • Piwigo VendorPiwigo Affected before 16.4.0 Fixed in 16.4.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*——Piwigo
  • cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:* Versions — — ·Piwigo

Remediation

  • Fix · CNA Piwigo (Piwigo) Fixed in 16.4.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44642

References

Other 4

  • TI-2026-27251 Piwigo RCE via PHP Code Injection into Config File in Installer CVSS 3.1CRITICAL 9.8
  • TI-2023-16500 Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function. CVSS 3.1CRITICAL 9.8
  • TI-2026-44470 Piwigo: Unauthenticated SQL injection in `pwg.images.filteredSearch.create` CVSS 3.1CRITICAL 9.1
  • TI-2023-16499 Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php. CVSS 3.1CRITICAL 9.8
  • TI-2023-23899 Piwigo Reflected XSS vulnerability CVSS 3.1CRITICAL 9.3
  • TI-2026-30629 Piwigo: Authenticated RCE via File Upload in Logo Upload Feature CVSS 3.1CRITICAL 9.1
See all 120 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences