CVE-2026-62262: Piwigo Unauthenticated SQL Injection Exposes Database Information TheHackerWire / 1d A crafted API request targeting the photo rating and search functionality allows remote attackers to extract sensitive database information or induce time-based delays, impacting data confidentiality and system availability. Telemetry Metric Intelligence Detail CVE Identifier CVE-2026-62262 CVSS Severity 9.1 CRITICAL Affected Target 17.0.0beta1 Vulnerability Class Security Vulnerability Exploit A

No standalone public exploit has been published in open research repositories at the time of writing. Our threat intelligence pipeline monitors GitHub, Exploit-DB, and Nuclei feeds continuously. Verified PoCs will be automatically integrated here upon discovery.

Piwigo versions 17.0.0beta1 and earlier are critically vulnerable to an unauthenticated SQL injection. A crafted API request targeting the photo rating and functionality allows remote attackers to extract sensitive database information or induce time-based delays, impacting data confidentiality and system availability.

Vulnerability Root Cause & Flaw Mechanism

CVE-2026-62262 stems from insufficient input validation within Piwigo’s functionality when photo rating is enabled. An unauthenticated guest initiates the attack by invoking the pwg.images.filteredSearch.create API method. This method accepts a ratings[] parameter, intended to filter images based on their rating. The core vulnerability resides in include/ws_functions/pwg.images.php , which stores the user-supplied, unvalidated ratings[] value directly into the application’s rules. Subsequently, when an attacker opens the returned URL, these stored rules are processed by include/functions_search.inc.php . This file attempts to integer-cast only the lower bound of the rating range. Crucially, the upper rating bound is concatenated directly into the SQL query without proper sanitization or type casting. This mechanical failure creates a classic SQL injection vector, enabling attackers to inject arbitrary SQL clauses into the database query, leading to error-based or blind extraction of database information and database-dependent time delays.

Attack Prerequisites & Threat Vector

Successful exploitation of CVE-2026-62262 requires minimal prerequisites. The attack is entirely unauthenticated, meaning no prior account or session is needed. The vulnerable Piwigo instance must be accessible over the network, typically via WAN, as it’s a web application. The core condition for the vulnerability to manifest is that the photo rating feature must be enabled within the Piwigo configuration. No specific API tokens, nonces, or prior knowledge of the target’s internal data structures beyond the API endpoint and parameter names are necessary. The end-to-end attack progression involves two distinct steps: first, an unauthenticated HTTP POST request to the Piwigo API endpoint, specifically calling pwg.images.filteredSearch.create with a maliciously crafted ratings[] array. This request injects the payload into the stored rules. Second, the attacker must then navigate to the URL returned by the API call, which triggers the execution of the stored, malicious SQL query against the database, revealing information or causing delays.

Detection, Log Analysis & Threat Hunting

SOC analysts and threat hunters should focus on web server access logs and application-specific logs for anomalous activity. Key indicators include requests to the Piwigo API endpoint (e.g., /ws.php or similar) containing the pwg.images.filteredSearch.create method. Scrutinize the ratings[] parameter within these requests for non-integer values, SQL keywords (e.g., UNION , SELECT , SLEEP ), ( -- , # ), or other SQL special characters ( ' , " ). Look for subsequent requests to URLs that might exhibit unusual response times, indicative of time-based SQL injection payloads. Error logs should be monitored for database-related errors (e.g., SQL syntax errors, database connection issues) coinciding with these requests. For asset discovery, a relevant Shodan or Google Dork query would be http.html:"Powered by Piwigo" or http.title:"Piwigo" to identify publicly exposed Piwigo instances. Further refinement could include http.html:"Piwigo" "rating" to narrow down instances where the rating feature might be enabled.

Defensive Hardening & Mitigation

Given the absence of a vendor-provided patch, immediate defensive hardening measures are critical. Implement a Web Application Firewall (WAF) rule to inspect and block requests to the Piwigo API endpoint (e.g., /ws.php ) where the ratings[] parameter contains SQL injection payloads or non-numeric values. Specifically, enforce strict input validation for the ratings[] parameter, ensuring it only accepts integer values within an expected range. If the photo rating feature is not essential for public access, consider disabling it or restricting access to authenticated users only, though the vulnerability is triggered via the function’s handling of rating parameters. Network segmentation should be applied to isolate Piwigo instances from sensitive internal networks. Implement database user least privilege, ensuring the Piwigo application’s database user has only the minimum necessary permissions. As of this review, no fixed version for Piwigo addressing CVE-2026-62262 is publicly available, necessitating proactive perimeter and application-level defenses.

Related Vulnerabilities

CVE-2026-93647: Zimbra Classic Stored XSS via Malicious Calendar Message Enables Mailbox Takeover

CVE-2026-92609: Apache Qpid Broker-J Session Fixation Allows Remote Management Session Hijack

CVE-2026-93643: Zimbra OnlyOffice Unauthenticated Path Traversal RCE as Zimbra User

TheHackerWire Threat Intel Team