Piwigo : Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulne - CVE-2026-42324 - Vulnerability Database

Piwigo

Piwigo : Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulne - CVE-2026-42324

Low

Reference: CVE-2026-42324

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-42324

Title: Piwigo : Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulne

Overview:

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0 admin/element_set_ranks.php stores administrator-controlled image_order values without enforcing the existing sort-field whitelist. The stored album image_order expression is later concatenated into ORDER BY clauses by admin/batch_manager_global.php admin/batch_manager_unit.php include/section_init.inc.php and include/ws_functions/pwg.categories.php. When at least one album contains at least one ph