CVE-2026-27834: Piwigo SQL Injection Vulnerability

CVE-2026-27834 Overview

CVE-2026-27834 is a SQL Injection vulnerability affecting Piwigo, an open source photo gallery application for the web. Prior to version 16.3.0, the pwg.users.getList Web Service API method contains a critical flaw where the filter parameter is directly concatenated into a SQL query without proper sanitization. This allows authenticated administrators to execute arbitrary SQL commands against the underlying database.

Critical Impact
Authenticated administrators can leverage this SQL Injection vulnerability to read, modify, or delete database contents, potentially compromising the entire photo gallery application and underlying system data.

Affected Products

Piwigo versions prior to 16.3.0
Piwigo pwg.users.getList Web Service API endpoint
All Piwigo installations with administrative API access enabled

Discovery Timeline

April 3, 2026 - CVE-2026-27834 published to NVD
April 9, 2026 - Last updated in NVD database

Technical Details for CVE-2026-27834

Vulnerability Analysis

This SQL Injection vulnerability resides in the pwg.users.getList Web Service API method within the Piwigo photo gallery application. The root cause is insufficient input validation and lack of proper parameterization when constructing database queries. When an authenticated administrator interacts with this API endpoint, the filter parameter value is directly concatenated into the SQL query string without sanitization or escaping.

The vulnerability requires administrator-level privileges to exploit, which limits the attack surface to authenticated sessions. However, once exploited, an attacker with administrative access could extract sensitive data from the database, modify records, or potentially achieve database server compromise depending on database permissions and configuration.

Root Cause

The vulnerability stems from improper input sanitization in the include/ws_functions/pwg.users.php file. The filter parameter was being directly interpolated into a SQL query that searches the GROUPS_TABLE for matching group names. Without proper escaping using functions like pwg_db_real_escape_string(), malicious SQL syntax within the filter parameter would be interpreted as part of the query structure rather than as literal search text.

Attack Vector

The attack is network-based and requires the attacker to have authenticated administrator credentials. The vulnerable endpoint is the pwg.users.getList Web Service API method. An attacker would craft a malicious filter parameter containing SQL injection payloads designed to manipulate the query execution. Common attack patterns include UNION-based injection to extract data from other tables, time-based blind injection for data exfiltration, or stacked queries for database modification.

php

   $filtered_groups = array();
   if (!empty($params['filter']))
   {
-    $filter_query = 'SELECT id FROM `'. GROUPS_TABLE .'` WHERE name LIKE \'%'. $params['filter'] . '%\';';
+    $filter_query = 'SELECT id FROM `'. GROUPS_TABLE .'` WHERE name LIKE \'%'. pwg_db_real_escape_string($params['filter']) . '%\';';
     $filtered_groups_res = pwg_query($filter_query);
     while ($row = pwg_db_fetch_assoc($filtered_groups_res))
     {

Source: GitHub Commit 9df471f

Detection Methods for CVE-2026-27834

Indicators of Compromise

Unusual or malformed requests to the pwg.users.getList API endpoint containing SQL syntax characters such as single quotes, semicolons, or UNION keywords
Database error messages or unexpected query behavior logged from the Piwigo application
Anomalous database queries originating from the web application process that include unexpected SQL operations
Evidence of data exfiltration or unauthorized database modifications in audit logs

Detection Strategies

Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in API requests to Piwigo endpoints
Enable detailed database query logging and monitor for queries containing suspicious patterns from the pwg.users.getList function
Configure intrusion detection systems (IDS) to alert on network traffic containing common SQL injection payloads targeting the Piwigo application
Review Piwigo application logs for repeated failed API calls or error responses that may indicate exploitation attempts

Monitoring Recommendations

Continuously monitor web server access logs for requests to the pwg.users.getList endpoint with unusual parameter values
Set up alerting for database connection errors or query failures that could indicate SQL injection attempts
Implement rate limiting on API endpoints to slow potential automated exploitation attempts
Audit administrative account activity and access patterns for any anomalous behavior

How to Mitigate CVE-2026-27834

Immediate Actions Required

Upgrade Piwigo to version 16.3.0 or later immediately to patch this vulnerability
Review administrative account credentials and ensure strong password policies are enforced
Audit recent API access logs for any signs of exploitation prior to patching
Consider temporarily restricting access to the Web Service API if immediate patching is not possible

Patch Information

Piwigo has released version 16.3.0 which addresses this SQL Injection vulnerability. The fix implements proper input sanitization using the pwg_db_real_escape_string() function to escape user-supplied input before inclusion in SQL queries. Organizations should upgrade to this version as soon as possible.

For detailed patch information, refer to the GitHub Security Advisory GHSA-5jwg-cr5q-vjq2 and the Piwigo Release Announcement for version 16.3.0.

Workarounds

If immediate patching is not possible, restrict network access to the Piwigo Web Service API to trusted IP addresses only
Implement a reverse proxy or WAF with SQL injection filtering rules in front of the Piwigo application
Disable or restrict access to the pwg.users.getList API method until the patch can be applied
Audit and minimize the number of administrator accounts with API access

bash

# Example: Restrict access to Piwigo API via Apache configuration
<Location "/ws.php">
    Require ip 192.168.1.0/24
    Require ip 10.0.0.0/8
</Location>