Executive brief
Piwigo is an open-source photo gallery application used to manage and display image collections on the web. A security flaw in the user management interface allows an administrator to execute unauthorized database commands. This could lead to the theft of sensitive user data, modification of gallery settings, or full takeover of the application's database.
Technical details
A SQL injection vulnerability exists in Piwigo's Web Service API within the 'pwg.users.getList' method. The root cause is the direct concatenation of the 'filter' parameter into a SQL query string inside 'include/ws_functions/pwg.users.php' without sanitization or the use of prepared statements. An attacker with administrative privileges can exploit this by sending a crafted POST request to 'ws.php', allowing for arbitrary SQL command execution. This can result in full database compromise, including the extraction of user credentials and metadata. The vulnerability is resolved in version 16.3.0 by implementing proper string escaping using 'pwg_db_real_escape_string()'.
Affected products
- Piwigo Piwigo < 16.3.0
Timeline
- 2026-01-27: disclosed: Private disclosure to vendor by researcher Albert Corzo
- 2026-02-24: patched: Version 16.3.0 released
- 2026-04-01: advisory: GitHub Security Advisory published
- 2026-04-03: disclosed: NVD publication date