The vulnerability occurs when four date filter parameters are concatenated directly into an SQL query without escaping or validation. This SQL injection flaw (CWE‑89) permits an unauthenticated user to retrieve the entire database, including user password hashes. The flaw exists in all releases prior to 16.3.0 and requires only access to the web interface that calls the vulnerable function.

All installations of Piwigo running any release before 16.3.0 are affected. Versions 16.2.x and earlier are vulnerable. The issue was corrected in the 16.3.0 release and applies to every Piwigo distribution identified by the CNA.

The CVSS score indicates high severity (8.7). The EPSS score of less than 1% suggests that active exploitation is currently uncommon, yet the flaw is publicly known and not listed in the CISA KEV catalog, meaning no documented active attacks are reported yet. Based on the description, it is inferred that the attacker can trigger the flaw via a crafted HTTP request to the ws_std_image_sql_filter endpoint, supplying malicious values for the date filter parameters. Because authentication is not required and the endpoint is network exposed, exploitation can be attempted from any external position, resulting in full database disclosure.