{"id":"CVE-2026-27834","aliases":["EUVD-2026-18872","GHSA-5jwg-cr5q-vjq2"],"status":"published","title":"Piwigo: SQL Injection in pwg.users.getList API Method via filter Parameter","description":"Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability exists in the pwg.users.getList Web Service API method. The filter parameter is directly concatenated into a SQL query without proper sanitization, allowing authenticated administrators to execute arbitrary SQL commands. This issue has been patched in version 16.3.0.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00378,"percentile":0.32205,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2026-04-03T21:35:13Z","modified":"2026-10-28T02:30:22Z","products":[{"vendor":"piwigo","product":"piwigo"}],"references":[{"url":"https://github.com/Piwigo/Piwigo/security/advisories/GHSA-5jwg-cr5q-vjq2","tags":["x_refsource_CONFIRM","exploit","Exploit","Mitigation","Vendor Advisory","advisory"]},{"url":"https://github.com/Piwigo/Piwigo/commit/9df471f16243371dc3725c5262e1632d23c8218a","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://piwigo.org/release-16.3.0","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27834.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27834","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-27834","title":"Piwigo: SQL Injection in pwg.users.getList API Method via filter Parameter","description":"Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability exists in the pwg.users.getList Web Service API method. The filter parameter is directly concatenated into a SQL query without proper sanitization, allowing authenticated administrators to execute arbitrary SQL commands. This issue has been patched in version 16.3.0.","status":"published","published":"2026-04-03T21:35:13.966Z","modified":"2026-04-06T15:42:28.113Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:19:48.826324Z"}],"euvd":[{"id":"EUVD-2026-18872","description":"Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability exists in the pwg.users.getList Web Service API method. The filter parameter is directly concatenated into a SQL query without proper sanitization, allowing authenticated administrators to execute arbitrary SQL commands. This issue has been patched in version 16.3.0.","status":"published","published":"2026-04-03T21:35:13Z","modified":"2026-04-06T15:42:28Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:25:15.794407Z"}],"nvd":[{"id":"CVE-2026-27834","description":"Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability exists in the pwg.users.getList Web Service API method. The filter parameter is directly concatenated into a SQL query without proper sanitization, allowing authenticated administrators to execute arbitrary SQL commands. This issue has been patched in version 16.3.0.","status":"published","published":"2026-04-03T22:16:26.013Z","modified":"2026-07-24T22:10:00.14Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:13.1424Z"}],"osv":[{"id":"CVE-2026-27834","title":"Piwigo: SQL Injection in pwg.users.getList API Method via filter Parameter","description":"Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability exists in the pwg.users.getList Web Service API method. The filter parameter is directly concatenated into a SQL query without proper sanitization, allowing authenticated administrators to execute arbitrary SQL commands. This issue has been patched in version 16.3.0.","status":"published","published":"2026-04-03T21:35:13.966Z","modified":"2026-10-28T02:30:22.295338926Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:45:00.180685Z"}]}}