# CVE-2026-35048: Piwigo PHP code injection in installer

Source: https://junglewise.ai/threats/cve-2026-35048-piwigo-php-code-injection-in-installer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-20. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-35048 · Severity: critical · CVSS 9.8 · Published 2026-07-20

Piwigo is a popular open-source photo gallery software. A vulnerability in its installation process allows an unauthenticated attacker to take full control of the web server by injecting malicious code into the database configuration file. This could lead to a total compromise of the website, including the theft of customer data, deletion of files, or the installation of persistent backdoors.

Technologies: [Piwigo](https://junglewise.ai/threats/technologies/piwigo). Vendors: [Piwigo](https://junglewise.ai/threats/vendors/piwigo).

## Quick answers

**Is CVE-2026-35048 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35048 being exploited in the wild.

**How severe is CVE-2026-35048?** Critical severity, with a CVSS score of 9.8, published 20 July 2026.

**Which products and versions are affected?** Piwigo <= 16.3.0.

**Is there a fix for CVE-2026-35048?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-35048 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-35048?** Check whether you run Piwigo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A PHP code injection vulnerability exists in Piwigo's `install.php` component. The installer accepts POST parameters (such as `prefix`, `dbpasswd`, or `dbhost`) and writes them directly into `local/config/database.inc.php` without adequate sanitization. On PHP 8.0 and later, the application's reliance on `addslashes()` is bypassed because the internal logic incorrectly checks for `get_magic_quotes_gpc()`, a function removed in PHP 8.0. An unauthenticated attacker can provide a crafted payload that escapes the configuration string and executes arbitrary system commands via `system()` or similar functions. This code is then executed every time a page is loaded on the site. No patch was available at the time of the advisory.

## Affected products

- Piwigo Piwigo <= 16.3.0

## Timeline

- 2026-07-18: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: NVD publication date

## References

- [https://github.com/Piwigo/Piwigo/security/advisories/GHSA-gphq-34pv-gvf3](https://github.com/Piwigo/Piwigo/security/advisories/GHSA-gphq-34pv-gvf3)

## Related threats

- [Piwigo SQL injection in image rating search](https://junglewise.ai/threats/cve-2026-62262-piwigo-is-a-full-featured-open-source-photo-gallery-application)
- [Piwigo SQL injection in upgrade authentication](https://junglewise.ai/threats/cve-2026-44642-piwigo-is-a-full-featured-open-source-photo-gallery-application)
- [Piwigo SQL injection via unvalidated image_order parameter](https://junglewise.ai/threats/cve-2026-42324-piwigo-is-a-full-featured-open-source-photo-gallery-application)
- [Piwigo SQL injection in batch manager filter](https://junglewise.ai/threats/cve-2026-42323-piwigo-is-a-full-featured-open-source-photo-gallery-application)
- [Piwigo arbitrary code execution via logo upload extension validation bypass](https://junglewise.ai/threats/cve-2026-42322-piwigo-is-a-full-featured-open-source-photo-gallery-application)