VYPR
← All advisories
High severity7.2NVD Advisory· Published Apr 3, 2026· Updated Apr 9, 2026

CVE-2026-27834

CVE-2026-27834

Description

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability exists in the pwg.users.getList Web Service API method. The filter parameter is directly concatenated into a SQL query without proper sanitization, allowing authenticated administrators to execute arbitrary SQL commands. This issue has been patched in version 16.3.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Piwigo/Piwigo2 versions
    cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*range: <16.3.0
    • (no CPE)range: <16.3.0

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.