This vulnerability is a SQL injection in Piwigo's upgrade authentication that lets an unauthenticated attacker supply a crafted username. Because the code only escapes the username when PHP's old get_magic_quotes_gpc function exists, PHP 8 and newer concatenate the raw string into the SQL query. When an upgrade is pending, a crafted query result can satisfy the authentication checks, set the upgrade flag, and allow the attacker to execute an upgrade without valid administrator credentials. The result is unauthorized modifications to the database and possible service disruption.

Piwigo is a popular web photo gallery. All versions released before 16.4.0 are vulnerable. The problem is in admin/include/functions_upgrade.php inside the check_upgrade_access_rights function. Users running older installations of Piwigo, especially those that have not yet applied the 16.4.0 release, are at risk.

The CVSS score of 8.1 indicates a high severity issue. The EPSS score is now 1%, indicating a very low but non-zero exploitation probability, but the lack of an KEV listing does not reduce the risk. The attack vector is derived from the description: any web visitor can submit a crafted username during an upgrade operation, so the vulnerability can be exploited without authentication and over the public URL of the upgrade page. Because it allows privilege escalation, the potential damage is substantial, particularly in environments where backups are infrequent or where the gallery holds valuable data.