CVE-2026-35048: Piwigo Installer RCE Vulnerability

CVE-2026-35048 Overview

CVE-2026-35048 is an unauthenticated PHP code injection vulnerability in the Piwigo photo gallery installer. Piwigo versions 16.3.0 and earlier accept POST parameters for database configuration and write them into a PHP configuration file without proper sanitization. On PHP 8 and later, the legacy addslashes() protection is bypassed because it depends on get_magic_quotes_gpc(), a function removed in PHP 8.0. Attackers can inject arbitrary PHP through the prefix, dbpasswd, dbhost, dbname, or dbuser POST parameters. The injected code is written to local/config/database.inc.php and executed on every subsequent page load, yielding full server-side code execution. The vulnerability is classified under [CWE-20] Improper Input Validation.

Critical Impact
An unauthenticated remote attacker can achieve arbitrary PHP code execution on any Piwigo instance running versions 16.3.0 or earlier on PHP 8+, leading to complete web application compromise.

Affected Products

Piwigo 16.3.0 and all earlier releases
Piwigo installations running on PHP 8.0 or later
Any environment exposing the Piwigo installer endpoint to the network

Discovery Timeline

2026-07-20 - CVE-2026-35048 published to the National Vulnerability Database
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-35048

Vulnerability Analysis

The Piwigo installer accepts user-supplied database configuration values through HTTP POST requests. The installer then generates a PHP configuration file that hardcodes these values as string literals. To prevent breaking the resulting PHP syntax, the installer applies addslashes() to escape quote characters. This escaping is guarded by a call to get_magic_quotes_gpc(), a compatibility check originally intended to avoid double-escaping on legacy PHP versions. PHP 8.0 removed get_magic_quotes_gpc() entirely, so the conditional path that calls addslashes() never executes on modern PHP runtimes. Raw attacker-controlled input is interpolated directly into PHP source. The resulting local/config/database.inc.php file is included on every page load, so injected code runs with the privileges of the web server process.

Root Cause

The root cause is reliance on a deprecated and removed PHP compatibility function to gate input sanitization. The installer treats sanitization as conditional rather than mandatory, and it writes trusted-looking configuration data to executable PHP without contextual escaping or type validation.

Attack Vector

An unauthenticated attacker sends a crafted POST request to the Piwigo installer endpoint with malicious PHP payloads embedded in any of the prefix, dbpasswd, dbhost, dbname, or dbuser fields. A payload can close the PHP string literal, inject arbitrary statements, and reopen a valid string to preserve file syntax. Once the installer writes database.inc.php, subsequent requests to any Piwigo page trigger execution of the attacker's code. Verified proof-of-concept code is not publicly listed at this time. Refer to the GitHub Security Advisory for further technical details.

Detection Methods for CVE-2026-35048

Indicators of Compromise

Unexpected modifications or write timestamps on local/config/database.inc.php
Presence of PHP function calls such as system(, exec(, passthru(, eval(, or base64_decode( inside database.inc.php
POST requests to Piwigo installer endpoints originating from unknown IP addresses after the initial deployment window
Web shells or new PHP files created under the Piwigo webroot with www-data or equivalent ownership

Detection Strategies

Review web server access logs for POST requests to installer paths containing suspicious characters such as backticks, semicolons, or PHP tags in dbuser, dbpasswd, dbhost, dbname, or prefix values
Perform file integrity monitoring on local/config/database.inc.php and alert on any change after initial installation
Scan the Piwigo webroot for files whose contents include shell execution primitives that should not appear in a configuration file

Monitoring Recommendations

Alert on outbound network connections initiated by the PHP-FPM or web server process to unexpected destinations
Monitor for child processes such as sh, bash, curl, or wget spawned by the web server user
Correlate installer endpoint access with subsequent anomalous PHP file modifications in the same webroot

How to Mitigate CVE-2026-35048

Immediate Actions Required

Upgrade Piwigo to a version later than 16.3.0 that includes the fix referenced in the vendor advisory
Remove or block access to the installer directory and script after deployment completes
Inspect local/config/database.inc.php on all existing instances for injected PHP and restore from a known-good backup if tampering is found
Rotate database credentials that were configured through the affected installer

Patch Information

The Piwigo maintainers have published fix details in the GitHub Security Advisory GHSA-gphq-34pv-gvf3. Administrators should upgrade to the patched release identified in that advisory and validate the presence of proper input sanitization independent of get_magic_quotes_gpc().

Workarounds

Restrict network access to the installer endpoint using web server access controls or a reverse proxy allow-list until the patch is applied
Deploy a web application firewall rule that blocks POST requests to installer paths containing PHP tags, backticks, or null bytes in database configuration parameters
Set the local/config/ directory and its files to read-only after installation to prevent overwrites of database.inc.php

bash

# Configuration example: block installer access at the web server layer (nginx)
location ~* /install(\.php)?$ {
    allow 10.0.0.0/8;
    deny all;
}

# Make the generated database config immutable post-install (Linux)
chmod 400 /var/www/piwigo/local/config/database.inc.php
chattr +i /var/www/piwigo/local/config/database.inc.php