CVE-2026-27885: Piwigo: SQL Injection in Activity.getList

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-03 · updated 2026-07-24
Weakness: CWE-89

Description

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability was discovered in Piwigo affecting the Activity List API endpoint. This vulnerability allows an authenticated administrator to extract sensitive data from the database, including user credentials, email addresses, and all stored content. This issue has been patched in version 16.3.0.

Affected products

Piwigo: before 16.3.0 — fixed in 16.3.0

How to fix

Upgrade to a fixed version: Piwigo 16.3.0. Check the vendor advisory for mitigations.

References

https://github.com/Piwigo/Piwigo/commit/c172d284e11eab4a5dbadd2844d26f734d5c8c72
https://github.com/Piwigo/Piwigo/security/advisories/GHSA-wfmr-9hg8-jh3m
https://piwigo.org/release-16.3.0

Get alerted when CVE-2026-27885 or the next vulnerability affects your stack