Piwigo : Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulne - CVE-2026-42323

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0 admin/batch_manager.php accepts administrator-controlled dimension width height and ratio values and filesize values from the Batch Manager filter URL without numeric validation. The URL filter parser stores those values in the bulk_manager_filter session state and later query construction concatenates them into SQL predicates unlike the validated POST filter path. An authenticated administrator can