CVE-2026-62262

Piwigo: Unauthenticated SQL injection in `pwg.images.filteredSearch.create`

Published Sep 25, 2026 CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Description

Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings[] value and then open the returned search URL. include/ws_functions/pwg.images.php stores the unvalidated value in the search rules, and include/functions_search.inc.php integer-casts only the lower rating bound while concatenating the raw value as the SQL upper bound. This allows error-based or blind extraction of database information and database-dependent time delays through the public search flow. No fixed version is available as of this review.

Analysis

Technical impact

An unauthenticated guest can invoke the pwg.images.filteredSearch.create endpoint with a crafted ratings[] value. The application stores the raw value in the search rules and later concatenates it as the SQL upper bound after only casting the lower bound to an integer. This flaw permits error‑based or blind SQL injection, enabling attackers to exfiltrate database data or create database‑dependent time delays. The weakness is a failure to properly validate and sanitize user input, identified as CWE‑89.

Affected Systems

Piwigo’s Piwigo photo‑gallery application, versions 17.0.0beta1 and all earlier releases. No fixed version has been published yet.

Risk and Exploitability

The CVSS score of 9.1 indicates high severity with full attacker impact. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack vector is unauthenticated access to the public search feature; an attacker can trigger the flaw by crafting a request to filteredSearch.create and then visiting the resulting search URL to extract data. Without a vendor patch, exploitation is possible on any publicly reachable instance.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Piwigo

affected

Version	Status	Constraints
`< 17.0.0beta1`	affected	—

No data.

Vendor Product Versions

Piwigo

Version	Status	Scheme	Platform
`[0,17.0.0beta1)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Restrict or disable the rating feature if not required, thereby removing the vulnerable endpoint from public use.
Apply the official code changes from the referenced commits (9755d88e and aede490a) to add proper input validation for the ratings[] parameter or replace the vulnerable code with a secure alternative.
If a patch is unavailable, block access to the pwg.images.filteredSearch.create endpoint for unauthenticated users or enforce authentication before allowing access to the search functionality.

Generated by OpenCVE AI on September 25, 2026 at 18:48 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.731% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact total

References

Link	Providers
https://github.com/Piwigo/Piwigo/commit/9755d88edf38b94bafdedb0b3aba7304a94e2e5c
https://github.com/Piwigo/Piwigo/commit/aede490a0b3a6c246f1f4689ca86c8fee377a7ae
https://github.com/Piwigo/Piwigo/security/advisories/GHSA-hq29-8hhx-5jwc

History

Sep 29, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 26, 2026 12:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Piwigo Piwigo piwigo
Vendors & Products		Piwigo Piwigo piwigo

Sep 25, 2026 4:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings[] value and then open the returned search URL. include/ws_functions/pwg.images.php stores the unvalidated value in the search rules, and include/functions_search.inc.php integer-casts only the lower rating bound while concatenating the raw value as the SQL upper bound. This allows error-based or blind extraction of database information and database-dependent time delays through the public search flow. No fixed version is available as of this review.
Title		Piwigo: Unauthenticated SQL injection in `pwg.images.filteredSearch.create`
Weaknesses		CWE-89
References		https://github.com/Piwigo/Piwigo/commit/9755d88edf38b94bafdedb0b3aba7304a94e2e5c https://github.com/Piwigo/Piwigo/commit/aede490a0b3a6c246f1f4689ca86c8fee377a7ae https://github.com/Piwigo/Piwigo/security/advisories/GHSA-hq29-8hhx-5jwc
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}`