CVE-2026-96673 in Photoview
Summary
by MITRE • 09/23/2026
Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the album_id path segment. Attackers can supply crafted SQL expressions in the album_id parameter to extract arbitrary data from the database using time-based or blind injection techniques.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/23/2026
Photoview versions up to 2.4.0 are susceptible to a critical unauthenticated SQL injection vulnerability located within the album download functionality. This security flaw arises because the application fails to properly sanitize user-supplied input before incorporating it into backend database queries. Specifically, the album_id parameter in the URL path segment is processed directly without adequate validation or encoding mechanisms. This lack of input sanitization allows malicious actors to inject arbitrary SQL commands that are executed by the underlying database management system with the privileges assigned to the application's database user account.
The technical nature of this vulnerability aligns closely with CWE-89, which defines Improper Neutralization of Special Elements used in an SQL Command. By manipulating the album_id path segment, attackers can bypass intended logic and execute destructive or extractive queries. The impact is severe because it does not require any form of authentication, meaning that any internet user accessing the application interface can exploit this flaw. This significantly lowers the barrier for entry compared to authenticated injection vulnerabilities, as no valid credentials are needed to initiate an attack sequence against the database backend.
Exploitation typically involves crafting specific SQL expressions designed to leverage time-based or blind injection techniques. In a time-based approach, attackers may append commands that cause the database to delay its response if certain conditions are met, allowing them to infer data based on timing differences. Blind injection methods involve manipulating queries so that the application's behavior changes depending on whether injected predicates evaluate to true or false, enabling the extraction of sensitive information bit by bit without direct output display. Through these techniques, attackers can extract arbitrary data from the database, including user credentials, personal identifiable information stored in photo metadata, and other confidential records managed by Photoview.
This vulnerability maps directly to MITRE ATT&CK technique T1059.004, which covers SQL Injection as a subset of Command and Scripting Interpreter abuse. The ability to extract arbitrary data constitutes an Information Exfiltration scenario under the Collection phase of the attack lifecycle. If successful, this could lead to full database compromise, allowing attackers to read, modify, or delete critical application data. In worst-case scenarios where the database service account has elevated privileges on the host system, further exploitation such as command execution via stored procedures might be possible, leading to complete server takeover.
Mitigation strategies must prioritize immediate patching and input validation updates. Users running Photoview versions 2.4.0 or earlier should upgrade to a patched version where this issue has been resolved by developers through proper parameterization of database queries. Until an update is applied, administrators can implement web application firewall rules that detect and block common SQL injection patterns in URL path segments containing album identifiers. Additionally, enforcing strict input validation on the server side to reject non-numeric characters or unexpected formats for the album_id field can serve as a temporary defensive measure while ensuring least privilege principles are enforced for database accounts used by the application.