CVE-2026-42323 Piwigo: SQL Injection in Batch Manager
An authenticated administrator can exploit SQL injection in the Batch Manager to disclose, modify, or disrupt database data.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-42323?
CVE-2026-42323 is a high-severity SQL injection vulnerability in Piwigo, published on 25 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/batch_manager.php accepts administrator-controlled dimension width, height, and ratio values and filesize values from the Batch Manager filter URL without numeric validation. The URL filter parser stores those values in the bulk_manager_filter session state, and later query construction concatenates them into SQL predicates, unlike the validated POST filter path. An authenticated administrator can use crafted filter values to execute time-based or other SQL expressions and potentially disclose, modify, or disrupt database data. This issue is fixed in version 16.4.0.
Weakness: CWE-89
Which versions are affected by CVE-2026-42323?
How do I fix CVE-2026-42323?
No fix has been published for CVE-2026-42323 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-42323 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42323 exists.
Sources
Also known as GHSA-7r67-9xhq-7p2c.