admin/batch_manager.php processes administrator‑controlled width, height, ratio and filesize parameters from the query string without numeric validation. Those values are stored in the bulk_manager_filter session and later concatenated into SQL predicates, unlike the validated POST filter path. This flaw allows an authenticated administrator to craft filter values that contain arbitrary SQL expressions, leading to time‑based or other SQL injections that can disclose, modify, or disrupt database data. The weakness is classified as CWE‑89.

The vulnerability affects the Piwigo photo gallery application, specifically all versions released before 16.4.0. Authorized administrators using the Batch Manager feature are susceptible to exploitation.

The CVSS score of 7.2 classifies this as High severity. EPSS is not available and the flaw is not listed in the CISA KEV catalog. The attack requires authenticated administrative access via the web interface; therefore, the exploitation likelihood depends on the protection of administrator credentials and the exposure of the Batch Manager endpoint. While no public exploits have been reported, the lack of numeric validation gives attackers a reliable path to inject malicious SQL once they reach the target system.