Vulnerability · Published Sep 23, 2026 · Assigned by VulnCheck
CVE-2026-96673Photoview through 2.4.0 SQL Injection via album download route
High 7.5
In plain English
A high-severity SQL injection in Photoview from Photoview. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 54.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the album_id path segment. Attackers can supply crafted SQL expressions in the album_id parameter to extract arbitrary data from the database using time-based or blind injection techniques.
Affected products (as reported)
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/photoview/photoview/pull/1453 patch, issue-tracking
- https://github.com/photoview/photoview/commit/deb1b216e047a30803dc0f48a9fc3d4c4abda594 patch
- https://github.com/photoview/photoview/blob/v2.4.0/api/routes/downloads.go#L19-L29 technical-description
- https://hackmd.io/@leediay/sqli-in-download-photoview third-party-advisory
- https://github.com/photoview/photoview product
- VulnCheck Advisory: Photoview through 2.4.0 SQL Injection via album download route third-party-advisory