An unauthenticated guest can invoke the pwg.images.filteredSearch.create endpoint with a crafted ratings[] value. The application stores the raw value in the search rules and later concatenates it as the SQL upper bound after only casting the lower bound to an integer. This flaw permits error‑based or blind SQL injection, enabling attackers to exfiltrate database data or create database‑dependent time delays. The weakness is a failure to properly validate and sanitize user input, identified as CWE‑89.

Piwigo’s Piwigo photo‑gallery application, versions 17.0.0beta1 and all earlier releases. No fixed version has been published yet.

The CVSS score of 9.1 indicates high severity with full attacker impact. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack vector is unauthenticated access to the public search feature; an attacker can trigger the flaw by crafting a request to filteredSearch.create and then visiting the resulting search URL to extract data. Without a vendor patch, exploitation is possible on any publicly reachable instance.