Vulnerability · Published Sep 25, 2026 · Assigned by GitHub_M

CVE-2026-44642Piwigo: SQL injection in upgrade authentication allows unauthenticated upgrade authorization bypass (PHP 8+)

High 8.1

In plain English

A high-severity SQL injection in Piwigo from Piwigo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)1.3%top 29.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, check_upgrade_access_rights() in admin/include/functions_upgrade.php conditionally escapes the submitted username only when the removed get_magic_quotes_gpc function exists, so PHP 8 and later concatenate an unauthenticated username directly into the upgrade authentication SQL query. When database upgrades are pending, a crafted query result can satisfy the status and password checks, set PHPWG_IN_UPGRADE, and authorize upgrade execution without valid administrator credentials. This can cause unauthorized database integrity changes and service disruption. This vulnerability is fixed in 16.4.0.

Affected products (as reported)

Vendor	Product	Versions
Piwigo	Piwigo	< 16.4.0

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/Piwigo/Piwigo/security/advisories/GHSA-6wj3-7fhw-gfpm x_refsource_CONFIRM
https://github.com/Piwigo/Piwigo/commit/1ff9d04534feb5f8f3cc2d3613c0fe8b51a1c0ba x_refsource_MISC
https://github.com/Piwigo/Piwigo/commit/2cfa7a3d194c8b95edde43038d8f5be5a359e785 x_refsource_MISC
https://github.com/Piwigo/Piwigo/releases/tag/16.4.0 x_refsource_MISC