CVE-2026-96673: Photoview SQL Injection Vulnerability

CVE-2026-96673 Overview

CVE-2026-96673 is a SQL injection vulnerability [CWE-89] in Photoview through version 2.4.0. The flaw resides in the album download route, where the album_id path segment is interpolated into a database query without proper sanitization. Unauthenticated attackers can send crafted requests containing SQL expressions in the album_id parameter to extract arbitrary data from the backend database. Exploitation uses time-based or blind injection techniques, allowing attackers to exfiltrate credentials, session data, and media metadata without authentication.

Critical Impact
Unauthenticated remote attackers can extract arbitrary data from the Photoview database via blind or time-based SQL injection against the album download endpoint.

Affected Products

Photoview through version 2.4.0
Self-hosted Photoview instances exposing the /download album route
Deployments not patched by commit deb1b216e047a30803dc0f48a9fc3d4c4abda594

Discovery Timeline

2026-09-23 - CVE-2026-96673 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-96673

Vulnerability Analysis

Photoview is an open-source, self-hosted photo management application written in Go. The vulnerable code path is the album download handler defined in api/routes/downloads.go. The handler extracts the album_id value from the URL path using gorilla/mux and passes it into a database query without validating that the value is an integer or applying parameterized query semantics.

Because the route is reachable without authentication, any attacker with network access to the Photoview API can trigger the injection. The database driver executes the attacker-supplied SQL fragment, enabling data exfiltration through boolean or time-delay side channels. Successful exploitation targets confidentiality of user records, hashed credentials, and album metadata stored in the backing database.

Root Cause

The root cause is direct string concatenation of untrusted path input into a SQL query. The handler treated album_id as trusted string data rather than converting it to an integer via strconv.Atoi before use. The upstream fix in pull request #1453 introduces strconv and errors imports and adds explicit type validation before the value reaches the database layer.

Attack Vector

Exploitation requires only network access to the Photoview HTTP API. The attacker issues a GET request to the album download endpoint and substitutes SQL syntax in place of a numeric album identifier. Blind injection payloads such as 1 AND SLEEP(5) or conditional CASE expressions allow byte-by-byte extraction of database contents.

// Patch context: api/routes/downloads.go
import (
    "archive/zip"
    "errors"
    "fmt"
    "io"
    "log"
    "net/http"
    "os"
    "strconv"
    "strings"

    "github.com/gorilla/mux"
)

Source: GitHub commit deb1b216. The fix introduces strconv for integer parsing and errors for typed error handling, enforcing that album_id is a valid integer before any database operation.

Detection Methods for CVE-2026-96673

Indicators of Compromise

HTTP requests to the Photoview /download album route where the album_id path segment contains non-numeric characters, quotes, parentheses, or SQL keywords such as SELECT, UNION, SLEEP, or CASE.
Unusually long response times from the album download endpoint, consistent with time-based blind injection payloads.
Repeated sequential requests to the same endpoint with incrementally varying payloads, indicating automated data extraction.

Detection Strategies

Deploy web application firewall rules that reject requests to /download/* when the album identifier fails an integer regex validation such as ^[0-9]+$.
Enable database query logging on the Photoview backend and alert on queries containing untyped or malformed album_id values.
Correlate HTTP access logs with database slow-query logs to surface time-based injection attempts.

Monitoring Recommendations

Monitor Photoview reverse proxy or ingress logs for anomalous URL patterns targeting download routes.
Track outbound data volume from the Photoview host to identify staged exfiltration following successful injection.
Alert on new or unexpected database read patterns against user, session, or credential tables.

How to Mitigate CVE-2026-96673

Immediate Actions Required

Upgrade Photoview to a version that includes commit deb1b216e047a30803dc0f48a9fc3d4c4abda594 from pull request #1453.
Restrict network exposure of the Photoview API to trusted networks or VPN clients until the patch is applied.
Rotate any credentials, API tokens, or session secrets stored in the Photoview database if exploitation is suspected.

Patch Information

The upstream fix is available in the Photoview repository via pull request #1453 and the corresponding commit deb1b216. Additional technical analysis is published in the VulnCheck advisory and the HackMD writeup.

Workarounds

Place Photoview behind a reverse proxy that enforces ^/download/[0-9]+/?$ path validation and rejects all other patterns.
Require authentication at the reverse proxy layer for the download route until the application-level patch is deployed.
Deploy a WAF rule set that blocks SQL keywords and quote characters in URL path segments handled by Photoview.

bash

# Example nginx location block enforcing numeric album_id
location ~ ^/download/([0-9]+)/?$ {
    proxy_pass http://photoview_backend;
}
location ~ ^/download/ {
    return 400;
}