CVE-2026-35048 in Piwigo
Summary
by MITRE • 07/20/2026
The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization. On PHP 8+, the `addslashes()` protection is bypassed because it checks for `get_magic_quotes_gpc()`, a function removed in PHP 8.0. This allows raw user input to be interpolated directly into PHP source code. An unauthenticated attacker can inject arbitrary PHP code through POST parameters (prefix, dbpasswd, dbhost, dbname, or dbuser), which gets written to `local/config/database.inc.php` and executed on every page load.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability exists in the Piwigo image gallery software where the installer process fails to properly sanitize user input when writing database configuration parameters to a PHP configuration file. The flaw affects versions 16.3.0 and earlier, creating a critical path for remote code execution attacks. When an attacker sends specially crafted POST requests containing malicious payloads through parameters such as prefix, dbpasswd, dbhost, dbname, or dbuser, the application directly interpolates these values into the database.inc.php configuration file without any input validation or sanitization measures.
The technical exploitation relies on PHP 8.0's removal of the get_magic_quotes_gpc() function which previously provided automatic escaping for certain characters in user input. In earlier PHP versions, this function would automatically escape quotes and other special characters, but its removal in PHP 8.0 means that the addslashes() protection mechanism fails to provide adequate security. This creates a direct injection vector where raw user input gets written verbatim into PHP source code, effectively allowing attackers to inject arbitrary PHP code that will execute every time the application loads. The vulnerable file location local/config/database.inc.php becomes a persistent backdoor for malicious code execution.
The operational impact of this vulnerability is severe as it allows unauthenticated remote code execution on affected systems. Attackers can inject malicious PHP payloads that may include web shells, command execution utilities, or other malicious code designed to establish persistent access to the compromised server. Since the injected code gets executed on every page load, the attack becomes persistent and can be used for data exfiltration, system reconnaissance, or further lateral movement within the network. The vulnerability essentially transforms a legitimate installation process into an attack vector that can compromise entire web applications.
Security mitigations should focus on immediate patching of affected versions to ensure proper input sanitization and validation before writing any user-provided data to configuration files. Organizations should implement strict parameter validation and sanitize all inputs through proper escaping mechanisms that work consistently across PHP versions. Additionally, the database.inc.php file should be protected from unauthorized write access, and the installation process should require authentication for configuration modifications. This vulnerability aligns with CWE-94 (Improper Control of Generation of Code) and follows ATT&CK technique T1059.007 (Unix Shell) when attackers leverage command execution capabilities through injected PHP code. Regular security audits should verify that no sensitive configuration files are writable by web applications and that all input validation is performed at multiple layers of the application stack to prevent similar injection vulnerabilities from occurring in other components.