CVE-2026-44642
Deferred Deferred - Pending Action

SQL Injection in Piwigo Prior to 16.4.0

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description
Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, check_upgrade_access_rights() in admin/include/functions_upgrade.php conditionally escapes the submitted username only when the removed get_magic_quotes_gpc function exists, so PHP 8 and later concatenate an unauthenticated username directly into the upgrade authentication SQL query. When database upgrades are pending, a crafted query result can satisfy the status and password checks, set PHPWG_IN_UPGRADE, and authorize upgrade execution without valid administrator credentials. This can cause unauthorized database integrity changes and service disruption. This vulnerability is fixed in 16.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-10-16
AI Q&A
2026-09-25
EPSS Evaluated
2026-10-14
NVD
CVE-2026-44642
EUVD
EUVD-2026-87137

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
piwigo piwigo to 16.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Piwigo versions before 16.4.0 have an authentication bypass vulnerability in the upgrade process. The function check_upgrade_access_rights() incorrectly handles username escaping in PHP 8+, allowing unauthenticated users to manipulate SQL queries during upgrades. This can grant unauthorized access to execute database changes without valid admin credentials.

Detection Guidance

To detect this vulnerability, check if your Piwigo installation is running a version prior to 16.4.0. Run the command: php -r "echo version_compare(PHP_VERSION, '8.0.0', '>=') ? 'PHP 8+' : 'PHP <8';" to verify PHP version. Inspect admin/include/functions_upgrade.php for the check_upgrade_access_rights() function and confirm if it improperly handles username escaping.

Impact Analysis

An attacker could exploit this to gain unauthorized access to upgrade Piwigo, leading to unauthorized database modifications or service disruption. This may result in data corruption, loss of functionality, or complete system compromise if database integrity is altered maliciously.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements. Non-compliance may result in legal penalties, data breach notifications, and reputational damage.

Mitigation Strategies

Immediately upgrade Piwigo to version 16.4.0 or later. Disable automatic upgrade functionality if not required. Review database integrity and access logs for unauthorized changes. Ensure all administrator accounts use strong passwords.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44642. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart