# CVE-2026-27885: Piwigo SQL injection in Activity List API

Source: https://junglewise.ai/threats/cve-2026-27885-piwigo-sql-injection-in-activity-list-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-03. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-27885 · Severity: high · CVSS 7.2 · Published 2026-04-03

Piwigo is an open-source photo gallery application used to manage and display image collections on the web. A security flaw in the application's activity tracking system allows an authorized administrator to bypass security controls and access sensitive information from the underlying database. This could lead to the exposure of user credentials, email addresses, and private metadata, potentially compromising the entire installation.

Technologies: [Piwigo](https://junglewise.ai/threats/technologies/piwigo). Vendors: [Piwigo](https://junglewise.ai/threats/vendors/piwigo).

## Quick answers

**Is CVE-2026-27885 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27885 being exploited in the wild.

**How severe is CVE-2026-27885?** High severity, with a CVSS score of 7.2, published 3 April 2026.

**Which products and versions are affected?** Piwigo < 16.3.0.

**Is there a fix for CVE-2026-27885?** A patch was published on 2026-02-24: Piwigo version 16.3.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-27885 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-27885?** Check whether you run Piwigo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An error-based SQL injection vulnerability exists in the Piwigo Web Services API, specifically within the 'pwg.activity.getList' method. The root cause is a failure to define the 'id' parameter in the API method signature within 'ws.php', which allows it to bypass the framework's built-in type validation. Consequently, the 'id' parameter is passed directly to the 'ws_getActivityList' function in 'include/ws_functions/pwg.php', where it is concatenated into a SQL query without sanitization. An authenticated administrator can exploit this by sending a crafted POST request to 'ws.php' to extract sensitive data such as password hashes and email addresses via XPath syntax errors. The issue is fixed in version 16.3.0 by implementing proper parameter validation and sanitization.

## Affected products

- Piwigo Piwigo < 16.3.0

## Timeline

- 2026-01-01: disclosed: Vulnerability reported by researcher
- 2026-02-24: patched: Piwigo version 16.3.0 released
- 2026-04-01: advisory: GitHub Security Advisory published
- 2026-04-03: advisory: NVD entry created

## References

- [https://github.com/Piwigo/Piwigo/commit/c172d284e11eab4a5dbadd2844d26f734d5c8c72](https://github.com/Piwigo/Piwigo/commit/c172d284e11eab4a5dbadd2844d26f734d5c8c72)
- [https://github.com/Piwigo/Piwigo/security/advisories/GHSA-wfmr-9hg8-jh3m](https://github.com/Piwigo/Piwigo/security/advisories/GHSA-wfmr-9hg8-jh3m)
- [https://piwigo.org/release-16.3.0](https://piwigo.org/release-16.3.0)

## Related threats

- [Piwigo SQL injection in image rating search](https://junglewise.ai/threats/cve-2026-62262-piwigo-is-a-full-featured-open-source-photo-gallery-application)
- [Piwigo SQL injection in upgrade authentication](https://junglewise.ai/threats/cve-2026-44642-piwigo-is-a-full-featured-open-source-photo-gallery-application)
- [Piwigo SQL injection via unvalidated image_order parameter](https://junglewise.ai/threats/cve-2026-42324-piwigo-is-a-full-featured-open-source-photo-gallery-application)
- [Piwigo SQL injection in batch manager filter](https://junglewise.ai/threats/cve-2026-42323-piwigo-is-a-full-featured-open-source-photo-gallery-application)
- [Piwigo arbitrary code execution via logo upload extension validation bypass](https://junglewise.ai/threats/cve-2026-42322-piwigo-is-a-full-featured-open-source-photo-gallery-application)