CVE-2026-96673
Received Received - Intake

SQL Injection in Photoview via Album Download Route

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: VulnCheck

Description
Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the album_id path segment. Attackers can supply crafted SQL expressions in the album_id parameter to extract arbitrary data from the database using time-based or blind injection techniques.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-96673
EUVD
EUVD-2026-85345

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
photoview photoview to 2.4.0 (inc)
photoview photoview 2.4.0
photoview photoview to 2.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-96673 is an unauthenticated SQL injection flaw in PhotoView version 2.4.0 affecting the album download route. The vulnerability allows attackers to inject malicious SQL code via the album_id parameter in the URL path without needing authentication. This occurs because the application passes user-controlled input directly to a database query without validation or parameterization.

Detection Guidance

To detect CVE-2026-96673, test the PhotoView album download endpoint for SQL injection by sending crafted album_id values. Use curl commands like: curl -v 'http://target/api/album/SLEEP(5)/download' to check for time delays. If the server responds after a delay, SQL injection may be possible. Also try payloads like ' OR 1=1 -- or ' UNION SELECT 1,2,3 -- to test for blind or error-based injection.

  • Check PhotoView version 2.4.0 or earlier via system logs or version file. Look for requests to /album/{album_id}/download with unusual parameters.
Impact Analysis

An attacker could exploit this to extract sensitive data from the database using time-based or blind SQL injection techniques. This may include accessing unauthorized records, bypassing authorization checks, or performing unauthorized database operations. The impact includes potential data breaches, unauthorized access to private media, and compromise of the entire application database.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized data access or exposure. GDPR requires protecting personal data, and a breach could result in fines. HIPAA mandates safeguarding protected health information; unauthorized access violates these requirements. The high CVSS score indicates significant risk to data confidentiality and integrity.

Mitigation Strategies

Immediately update PhotoView to the latest version beyond 2.4.0, as the vulnerability was fixed in commit eb2bf91b. If updating is not possible, restrict access to the /album/{album_id}/download endpoint via firewall rules or disable it temporarily. Ensure database queries use parameterized statements and validate album_id as a positive integer before processing.

  • Monitor network traffic for suspicious requests targeting the album download route. Implement WAF rules to block SQL injection patterns like SLEEP(), UNION, or -- in album_id parameters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96673. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart