The vulnerability allows an attacker to inject arbitrary PHP code into the Piwigo database configuration file during installation. Because the installer writes POST parameters directly to the PHP source file without sanitization, the injected code is executed on every page load, providing full control over the server. The weakness is a classic input validation flaw, identified as CWE‑20, and the impact is complete compromise of confidentiality, integrity, and availability.

Inventories of Piwigo installations running version 16.3.0 or earlier are affected. The issue resides in the installer component of the Piwigo product, and any deployment that has not upgraded past the 16.3.0 release timeline remains vulnerable.

The CVSS base score of 9.8 indicates critical severity. The EPSS score of < 1% suggests a very low, but non‑zero, probability that this vulnerability is currently being exploited in the wild. Based on the description, it is inferred that the attacker can reach the installer via unauthenticated HTTP POST requests, giving them the ability to inject arbitrary PHP code that executes on every page load. The catalog status indicates it is not listed in CISA’s KEV, yet its high severity warrants immediate attention.