Photoview vulnerabilities
Published CVEs affecting Photoview products: 2 record(s), with severity, exploitation and fixes.
CVE-2026-96673
High · 7.5
CWE-89 Sep 23, 2026
Photoview through 2.4.0 SQL Injection via album download route
Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the album_id path segment. Attackers can supply crafted SQL expressions in the album_id parameter to extract arbitrary data from the database using time-based or blind injection techniques.
CVE-2026-96271
High · 7.1
CWE-639 Sep 22, 2026
Photoview through 2.4.0 Authorization Bypass via shareAlbum
Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate working share tokens for victim albums, exposing photos and sub-albums to anyone with the link while retaining indefinite control over token settings.