CVE-2026-42324 Piwigo: Second-Order SQL Injection
An authenticated administrator can exploit a second-order SQL injection in Piwigo to read, modify, or disrupt database data via crafted image order expressions.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-42324?
CVE-2026-42324 is a high-severity SQL injection vulnerability in Piwigo, published on 25 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/element_set_ranks.php stores administrator-controlled image_order[] values without enforcing the existing sort-field whitelist. The stored album image_order expression is later concatenated into ORDER BY clauses by admin/batch_manager_global.php, admin/batch_manager_unit.php, include/section_init.inc.php, and include/ws_functions/pwg.categories.php. When at least one album contains at least one photo, an authenticated administrator can store a crafted expression and trigger it in a later album or Batch Manager query to disclose, modify, or disrupt database data. This issue is fixed in version 16.4.0.
Weakness: CWE-89
Which versions are affected by CVE-2026-42324?
How do I fix CVE-2026-42324?
No fix has been published for CVE-2026-42324 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-42324 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42324 exists.
Sources
Also known as GHSA-jhp4-7f82-8f6q.