Is CVE-2026-27834 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27834 being exploited in the wild.

How severe is CVE-2026-27834?

High severity, with a CVSS score of 7.2, published 3 April 2026.

Is there a fix for CVE-2026-27834?

A patch was published on 2026-02-24: Version 16.3.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27834 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-27834?

Check whether you run Piwigo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27834: Piwigo SQL injection in pwg.users.getList API

CVE-2026-27834 · Severity: high · CVSS 7.2 · Published 2026-04-03

Piwigo is an open-source photo gallery application used to manage and display image collections on the web. A security flaw in the user management interface allows an administrator to execute unauthorized database commands. This could lead to the theft of sensitive user data, modification of gallery settings, or full takeover of the application's database.

Technologies: Piwigo. Vendors: Piwigo.

Quick answers

Is CVE-2026-27834 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27834 being exploited in the wild.
How severe is CVE-2026-27834?: High severity, with a CVSS score of 7.2, published 3 April 2026.
Which products and versions are affected?: Piwigo < 16.3.0.
Is there a fix for CVE-2026-27834?: A patch was published on 2026-02-24: Version 16.3.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27834 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-27834?: Check whether you run Piwigo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in Piwigo's Web Service API within the 'pwg.users.getList' method. The root cause is the direct concatenation of the 'filter' parameter into a SQL query string inside 'include/ws_functions/pwg.users.php' without sanitization or the use of prepared statements. An attacker with administrative privileges can exploit this by sending a crafted POST request to 'ws.php', allowing for arbitrary SQL command execution. This can result in full database compromise, including the extraction of user credentials and metadata. The vulnerability is resolved in version 16.3.0 by implementing proper string escaping using 'pwg_db_real_escape_string()'.

Affected products

Piwigo Piwigo < 16.3.0

Timeline

2026-01-27: disclosed: Private disclosure to vendor by researcher Albert Corzo
2026-02-24: patched: Version 16.3.0 released
2026-04-01: advisory: GitHub Security Advisory published
2026-04-03: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.