Piwigo, a popular web photo gallery application, has a flaw in the pwg.users.getList Web Service API. The filter parameter is concatenated straight into a SQL query without sanitization, creating a classic SQL injection vulnerability (CWE‑89). Since the API requires an authenticated administrator, an attacker who logs in with admin rights can run arbitrary SQL statements. This can lead to data exposure, modification, or deletion, and in some configurations may even trigger privileged operations on the underlying database server.

All Piwigo installations running a version earlier than 16.3.0 are vulnerable. The issue is addressed in Piwigo version 16.3.0, which removes the unsanitized filter usage.

The vulnerability has a CVSS score of 7.2, indicating high severity. The EPSS score is below 1 %, showing a low predicted exploit frequency, and it is not listed in CISA’s KEV catalog. Exploitation requires the attacker to have administrator authentication to the site and knowledge of the API. Once authenticated, the injected SQL can be executed with the privileges of the administrator or the database user used by Piwigo.