CVE-2026-42323 in Piwigo
Summary
by MITRE • 09/25/2026
Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/batch_manager.php accepts administrator-controlled dimension width, height, and ratio values and filesize values from the Batch Manager filter URL without numeric validation. The URL filter parser stores those values in the bulk_manager_filter session state, and later query construction concatenates them into SQL predicates, unlike the validated POST filter path. An authenticated administrator can use crafted filter values to execute time-based or other SQL expressions and potentially disclose, modify, or disrupt database data. This issue is fixed in version 16.4.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/25/2026
Piwigo serves as a comprehensive open-source photo gallery application designed for web deployment, offering extensive features for managing digital media collections. A critical security vulnerability was identified within the administrative interface of Piwigo versions prior to 16.4.0, specifically affecting the batch management functionality. The flaw resides in the file admin/batch_manager.php, which handles user inputs related to filtering and processing batches of images. This component accepts parameters controlling dimension width, height, aspect ratio, and filesize limits directly from URL query strings associated with the Batch Manager filter interface. Unlike other input paths within the application that enforce strict validation protocols, this specific endpoint fails to perform adequate numeric or type checking on these administrator-controlled values before they are processed further by the system logic.
The technical nature of this vulnerability constitutes an SQL injection flaw resulting from improper neutralization of special elements used in database queries. When a user submits filter criteria via the URL, the application parses these parameters and stores them within the session state under bulk_manager_filter without validating their format or content. Subsequently, when constructing SQL predicates to query the underlying database for matching images, the system concatenates these unvalidated values directly into the SQL statement string. This lack of sanitization allows an attacker who has obtained valid administrative credentials to inject arbitrary SQL code through crafted filter parameters. The vulnerability is classified under CWE-89 as Improper Neutralization of Special Elements used in an SQL Command, highlighting the failure to properly escape or parameterize user-supplied input before its inclusion in a database query structure.
The operational impact of this flaw is significant due to the high privilege level required for exploitation and the sensitivity of the data involved. An authenticated administrator can leverage crafted filter values to execute time-based blind SQL injection techniques, which allow for the extraction of sensitive information from the database through careful observation of response times or other side effects. Beyond data disclosure, the ability to inject arbitrary SQL expressions potentially enables unauthorized modification of gallery metadata, deletion of image records, or disruption of service availability by causing database errors or excessive resource consumption. This represents a severe risk as it compromises the integrity and confidentiality of the entire photo collection managed by the application. The attack vector is categorized under ATT&CK technique T1059, specifically Command Scripting via SQL Injection, where the attacker uses injected commands to interact with the backend data store directly rather than through intended application logic.
To mitigate this vulnerability, organizations running Piwigo must immediately upgrade to version 16.4.0 or later, which includes patches that enforce strict numeric validation on all filter parameters passed through the Batch Manager interface. For environments where immediate patching is not feasible due to operational constraints, temporary mitigations should focus on restricting access to administrative endpoints using strong network-level controls such as IP whitelisting and multi-factor authentication for admin accounts. Additionally, implementing a Web Application Firewall with rules capable of detecting SQL injection patterns in URL parameters can provide an additional layer of defense by blocking malicious payloads before they reach the application logic. Regular security audits and code reviews focusing on input validation practices are recommended to prevent similar issues arising from inconsistent handling of user inputs across different modules within the software ecosystem.