CVE-2026-9059: NextGEN Gallery: SQL Injection via REST API orderby parameter
NextGEN Gallery versions before 4.2.1 are affected by an authenticated SQL injection through the orderby parameter of two REST API endpoints. Tenable scores it 9.3 (critical) under CVSS v4.0, and the attacker needs a capability granted to Administrators by default. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.
Overview
NextGEN Gallery versions before 4.2.1 contain an authenticated SQL injection flaw in the 'orderby' parameter of the REST API endpoints /imagely/v1/galleries and /imagely/v1/albums. The record attributes the root cause to the _clean_column() sanitization function in the data mapper layer, which relies on a character blacklist instead of a whitelist. The weakness is classified as CWE-89.
Impact
- Tenable scores the issue 9.3 (critical) under CVSS v4.0, with high impact on confidentiality and integrity of the vulnerable system and high impact on confidentiality, integrity and availability of subsequent systems.
- The SSVC data in the record lists total technical impact, no known exploitation, and not automatable.
- Successful injection into an ORDER BY clause could expose or alter database content, depending on the configuration. The exact consequences are not detailed in the record.
Affected products and versions
- Product: Awesomemotive NextGEN Gallery.
- The record gives the range as '≥ O and < 4.2.1'. The lower bound appears garbled in the source, so the earliest affected version is unknown.
- No fixed version is listed in the record's fixes field. Because 4.2.1 is the upper boundary of the affected range, it is likely the first unaffected release, but this is an inference to confirm with the vendor.
Exploitation status
The CVE is not listed in CISA KEV in the record. No confirmed exploitation in the wild appears in the sources consulted. The SSVC exploitation field is 'none', and the EPSS probability is 0.00369 (percentile 0.28927).
Remediation and mitigation
- Upgrade NextGEN Gallery to version 4.2.1 or later, since the affected range places that version outside the vulnerable range.
- Review which accounts hold the NextGEN Gallery overview capability and restrict it to the minimum necessary, because the default Administrator assignment widens exposure.
- Limit the number of administrative accounts, use strong authentication, and monitor for account misuse.
- Consult the Tenable research advisory for further details.
Detection guidance
- Review web server and application logs for REST requests to the imagely namespace, especially the galleries and albums routes, that carry unusual or non-standard orderby values.
- Alert on repeated database query errors originating from these endpoints.
- Correlate such activity with authenticated sessions of privileged users.
Limitations of the available information
- The record does not describe the vulnerable code path beyond the function name, nor the database backend tested.
- The lower bound of the affected version range is unreadable in the source.
- The record's EPSS date (2026-10-13) is later than its publication date (2026-05-20) and should be interpreted with caution.
- No vendor advisory or patch note is included in the record, so fix details are unknown beyond the range boundary.
Frequently asked questions
Which versions of NextGEN Gallery are affected?
The record lists versions before 4.2.1 as affected. The lower bound of the range is garbled in the source, so the earliest affected version is unknown.
Does the attacker need to be logged in?
Yes. The record describes the flaw as authenticated and requires the NextGEN Gallery overview capability, which is assigned to the Administrator role by default.
Is this vulnerability being actively exploited?
The CVE is not listed in CISA KEV in the record, and no confirmed exploitation appears in the sources consulted. The SSVC exploitation field is none.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.