CVE-2026-27634CWE-89

Piwigo: Pre-auth SQL injection via date filter parameters in ws_std_image_sql_filter

High · published April 3, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
55.9
In the wild
Unconfirmed
What it is

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the four date filter parameters (f_min_date_available, f_max_date_available, f_min_date_created, f_max_date_created) in ws_std_image_sql_filter() are concatenated directly into SQL without any escaping or type validation. This could result in an unauthenticated attacker reading the full database, including user password hashes. This issue has been patched in version 16.3.0.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00792 · 55.9th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-04-03T21:33Z
EPSS history
Timeline
  • 03 APR 21:33Z
    Piwigo: Pre-auth SQL injection via date filter parameters in ws_std_image_sql_filter
    cvelistv5