PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-27885 Piwigo CVE debrief

A SQL Injection vulnerability was discovered in Piwigo, affecting the Activity List API endpoint. This vulnerability allows an authenticated administrator to extract sensitive data from the database, including user credentials, email addresses, and all stored content. The issue has been patched in version 16.3.0. An executive overview of the vulnerability reveals that it has a high CVSS score of 7.2 and is considered a high-severity vulnerability. Users of Piwigo versions prior to 16.3.0 should update to the latest version to prevent potential SQL Injection attacks.

Vendor
Piwigo
Product
Unknown
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-03
Original CVE updated
2026-07-24
Advisory published
2026-04-03
Advisory updated
2026-07-24

Who should care

Users of Piwigo versions prior to 16.3.0 should update to the latest version to prevent potential SQL Injection attacks. Affected operators, platforms, vulnerability-management, and security teams should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

The SQL Injection vulnerability in Piwigo's Activity List API endpoint allows an authenticated administrator to extract sensitive data from the database, including user credentials, email addresses, and all stored content. This issue has been patched in version 16.3.0. The vulnerability has a high CVSS score of 7.2 and is considered a high-severity vulnerability. Affected product deployments should be reviewed, and compensating controls should be implemented while remediation is scheduled and verified.

Defensive priority

High

Recommended defensive actions

  • Update Piwigo to version 16.3.0 or later
  • Restrict access to the Activity List API endpoint
  • Monitor for suspicious database activity
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-04-03T22:16:26.173Z and last modified on 2026-07-24T22:10:00.140Z. The NVD entry is currently Analyzed. Evidence from the CVE record and NVD entry indicates a SQL Injection vulnerability in Piwigo's Activity List API endpoint, allowing an authenticated administrator to extract sensitive data. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-03T22:16:26.173Z and has not been modified since then. The NVD entry is currently Analyzed.