CVE-2026-27634 is a critical SQL injection (CVSS 9.8) in Piwigo, the open source photo gallery. Four date filter parameters are added to a SQL query without escaping, so an unauthenticated user could read the full database, including password hashes. The record says Piwigo 16.3.0 fixes it.
What's affected
Piwigo before 16.3.0, per the NVD record. The affected code builds a SQL filter from four date parameters in an image query function. The advisory says several API methods that call it are reachable by guests when guest access is on, which is the default.
There is a version discrepancy to be aware of. The GitHub advisory page, as fetched, lists versions up to 16.4.0 as affected and no patched version, which conflicts with the record and with the 16.3.0 release notes that include a security fix. Do not read that as permission to stay put. Run the newest Piwigo release you can, and check the advisory for the final word on versions.
The KEV flag is false.
How to check if you're exposed
Check your Piwigo version in the administration area, or read it from the install.
grep -rn "PHPWG_VERSION" /path/to/piwigo/include/constants.php
If your gallery allows guests to browse, treat it as reachable from the internet by anyone. If it is only available on a private network or behind a login at the web server, the exposure is smaller.
What to do now
- Upgrade to Piwigo 16.3.0 or the latest release.
- Back up the database and files first, using your normal procedure.
- If you cannot upgrade immediately, consider turning off guest access or restricting the gallery by network, so anonymous users cannot reach the API.
- Treat password hashes as potentially exposed if the site was reachable while vulnerable. Force password resets for administrators.
- Review web logs for odd requests to the web service endpoint with long or unusual date parameters.
Why it matters
This is CWE-89, SQL injection. The advisory shows that numeric filter parameters are checked, but the date parameters are only tested for being set, so their value is concatenated into the query as text. Anything an attacker puts in the value becomes part of the statement.
The impact in the record is database read access, including password hashes. Because the entry points are reachable without an account in the default configuration, the bar for an attacker is low.
The standard fix is a parameterised query or strict type validation. When one function validates some inputs and not others, the unchecked ones are where the bug lives. A code scanner or a web application scan finds this pattern quickly, which is why we point at the demo below.
How to tell if your own gallery was probed
Time based and error based techniques leave traces. Look at your web server access logs for requests to the web service endpoint that carry unusual characters in the date parameters, including quote characters, comment markers or very long values, and for responses that took far longer than normal. If the database user for Piwigo can read other schemas, widen the review to those as well.
The advisory describes a flaw in a shared filtering function that several API methods call. That is why simply hiding one page does not close the hole. The function is reachable by whichever method calls it.
Reducing the blast radius
Even after you upgrade, apply a few standing habits to a photo gallery or any public web application.
- Give the application its own database account with the minimum rights needed, and do not reuse the account anywhere else.
- Keep the database off public networks.
- Use a strong, unique password for every administrator, and enable any available two factor option.
- Take regular backups and test restoring them.
- Subscribe to the project's release announcements, and update within days, not months.
What to do about the password hashes
If the gallery was reachable by guests on a vulnerable version, assume an attacker could have read the user table. Hashes are not plain passwords, but weak passwords can be recovered from hashes with enough effort. Force a reset for administrators first, then ask regular users to change theirs, and warn anyone who reused their password on other sites.
Finding this pattern before an attacker does
A dynamic scan of a running site can send benign test input to parameters and notice when the application reacts like a vulnerable query. The demo below walks through that kind of web application scan on a sample target.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can the database be modified, not just read?
The record's description focuses on reading the database. Treat integrity as at risk too, since SQL injection often allows more than the first demonstrated step.
Sources
Last reviewed: 19 October 2026.
