CVE-2026-44642
Piwigo is a full featured open source photo gallery application for the web
- Risk score
- 68/100
- CVSS
- 8.1 v3.1
- Exploit chance (30 days)
- 1.3%
- Published
- 25 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, check_upgrade_access_rights() in admin/include/functions_upgrade.php conditionally escapes the submitted username only when the removed get_magic_quotes_gpc function exists, so PHP 8 and later concatenate an unauthenticated u…
- Affected
- See advisory
- Fix
- Upgrade the product to 16.4.0 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.1 high
- Remotely exploitable without logging in
References
- https://github.com/Piwigo/Piwigo/commit/1ff9d04534feb5f8f3cc2d3613c0fe8b51a1c0ba
- https://github.com/Piwigo/Piwigo/commit/2cfa7a3d194c8b95edde43038d8f5be5a359e785
- https://github.com/Piwigo/Piwigo/releases/tag/16.4.0
- https://github.com/Piwigo/Piwigo/security/advisories/GHSA-6wj3-7fhw-gfpm
- https://github.com/Piwigo/Piwigo/security/advisories/GHSA-6wj3-7fhw-gfpm
Original description
Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, check_upgrade_access_rights() in admin/include/functions_upgrade.php conditionally escapes the submitted username only when the removed get_magic_quotes_gpc function exists, so PHP 8 and later concatenate an unauthenticated username directly into the upgrade authentication SQL query. When database upgrades are pending, a crafted query result can satisfy the status and password checks, set PHPWG_IN_UPGRADE, and authorize upgrade execution without valid administrator credentials. This can cause unauthorized database integrity changes and service disruption. This vulnerability is fixed in 16.4.0.
Last activity 25 Sep 2026. Patch Forecast updates every hour.