Executive brief
Piwigo is an open-source photo gallery application used to manage and display image collections on the web. A security flaw in the application's activity tracking system allows an authorized administrator to bypass security controls and access sensitive information from the underlying database. This could lead to the exposure of user credentials, email addresses, and private metadata, potentially compromising the entire installation.
Technical details
An error-based SQL injection vulnerability exists in the Piwigo Web Services API, specifically within the 'pwg.activity.getList' method. The root cause is a failure to define the 'id' parameter in the API method signature within 'ws.php', which allows it to bypass the framework's built-in type validation. Consequently, the 'id' parameter is passed directly to the 'ws_getActivityList' function in 'include/ws_functions/pwg.php', where it is concatenated into a SQL query without sanitization. An authenticated administrator can exploit this by sending a crafted POST request to 'ws.php' to extract sensitive data such as password hashes and email addresses via XPath syntax errors. The issue is fixed in version 16.3.0 by implementing proper parameter validation and sanitization.
Affected products
- Piwigo Piwigo < 16.3.0
Timeline
- 2026-01-01: disclosed: Vulnerability reported by researcher
- 2026-02-24: patched: Piwigo version 16.3.0 released
- 2026-04-01: advisory: GitHub Security Advisory published
- 2026-04-03: advisory: NVD entry created