CVE-2026-27634: Piwigo: pre-auth SQL injection in image date filter
Piwigo is a photo gallery application whose ws_std_image_sql_filter() function concatenates four date filter parameters into SQL without escaping or type validation. According to the record, an unauthenticated attacker could read the full database, including user password hashes. The issue is patched in version 16.3.0, and CISA KEV does not list it.
Overview
Piwigo is an open source photo gallery application. According to the record, four date filter parameters used by ws_std_image_sql_filter() are concatenated into SQL without escaping or type validation, which is a SQL injection weakness classified as CWE-89. The record describes the issue as reachable without authentication in versions before 16.3.0.
Impact
- The record states that an unauthenticated attacker could read the full database, including user password hashes.
- NVD assigns a base score of 9.8 and GitHub assigns 8.7, both in the critical or high range.
- SSVC rates technical impact as partial, which does not fully match the full-database read described in the text, so the sources should be reviewed together.
Affected products and versions
- Product: Piwigo Piwigo.
- Affected: versions before 16.3.0.
- Fixed: version 16.3.0, as referenced by the release notes and the patch commit.
Exploitation status
- CISA KEV does not list this CVE, and no confirmed active exploitation appears in the sources consulted.
- SSVC records the exploitation status as 'poc', which indicates that proof-of-concept material is recorded for this issue, not that it is used in attacks.
- The GitHub advisory reference carries an 'Exploit' tag in the record. That tag alone does not confirm exploitation in the wild.
- The record lists an EPSS probability of 0.00792 with a percentile of 0.55902.
Remediation and mitigation
- Upgrade Piwigo to version 16.3.0 or later, as stated in the release notes and advisory.
- Until the upgrade is applied, limit public exposure of the Piwigo web service where operationally possible, for example through network restrictions or a web application firewall.
- Apply least privilege to the database account used by Piwigo, and review whether user credential material could have been exposed. Rotate passwords and related secrets if exposure is suspected.
Detection guidance
- Review web server and application logs for requests to the image service that carry unusual or non-date values in the four date filter parameters.
- Monitor database activity for unusually large or atypical reads originating from the application account.
- Keep log alerts focused on anomalies rather than on specific attack strings.
Limitations of the available information
- The record does not describe the exact request conditions, and it does not confirm whether public exploit code exists beyond the reference tag.
- Whether other branches or deployment configurations are affected is unknown beyond the stated 'before 16.3.0' range.
- The EPSS date in the record is later than the publication date, so the EPSS values should be treated with caution.
Frequently asked questions
Which Piwigo versions are affected by CVE-2026-27634?
The record lists versions before 16.3.0 as affected. Version 16.3.0 contains the patch.
Can an attacker exploit this without logging in?
According to the record, the issue can be reached by an unauthenticated attacker, which is why the NVD base score is 9.8.
Is this vulnerability being actively exploited?
CISA KEV does not list this CVE, and no confirmed active exploitation appears in the sources consulted. SSVC records the exploitation status as proof-of-concept.
What should administrators do now?
Upgrade Piwigo to version 16.3.0 or later, limit public exposure until the upgrade is done, and review database access and possible credential exposure.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.