A SQL Injection flaw is present in the Activity List API endpoint of Piwigo prior to version 16.3.0. The vulnerability allows an authenticated administrator to supply malicious parameters that cause the backend to execute arbitrary SQL statements. This can lead to extraction of sensitive data such as user credentials, email addresses, and all stored content, resulting in a significant breach of confidentiality.

All installations of Piwigo before version 16.3.0 are impacted. The flaw exists in Piwigo’s out‑of‑the‑box photo gallery software and specifically affects the Activity List API endpoint used by administrators to view activity logs.

The CVSS score of 7.2 classifies the vulnerability as high severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The flaw is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. Because the vulnerability requires administrative authentication, an attacker must first have privileged access to the system or compromise an administrator account before data can be exfiltrated. Once authenticated, the attacker can retrieve all stored data through crafted requests to the vulnerable endpoint.