PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-27885 Piwigo CVE debrief

A SQL Injection vulnerability was discovered in Piwigo, affecting the Activity List API endpoint. This vulnerability allows an authenticated administrator to extract sensitive data from the database, including user credentials, email addresses, and all stored content. The issue has been patched in version 16.3.0. An executive overview of the vulnerability reveals that it has a high CVSS score of 7.2 and is considered a high-severity vulnerability. Users of Piwigo versions prior to 16.3.0 should update to the latest version to prevent potential SQL Injection attacks.

Vendor
Piwigo
Product
Unknown
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-03
Original CVE updated
2026-07-24
Advisory published
2026-04-03
Advisory updated
2026-07-24

Who should care

Users of Piwigo versions prior to 16.3.0 should update to the latest version to prevent potential SQL Injection attacks. Affected operators, platforms, vulnerability-management, and security teams should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

The SQL Injection vulnerability in Piwigo's Activity List API endpoint allows an authenticated administrator to extract sensitive data from the database, including user credentials, email addresses, and all stored content. This issue has been patched in version 16.3.0. The vulnerability has a high CVSS score of 7.2 and is considered a high-severity vulnerability. Affected product deployments should be reviewed, and compensating controls should be implemented while remediation is scheduled and verified.

Defensive priority

High

Recommended defensive actions

  • Update Piwigo to version 16.3.0 or later
  • Restrict access to the Activity List API endpoint
  • Monitor for suspicious database activity
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-04-03T22:16:26.173Z and last modified on 2026-07-24T22:10:00.140Z. The NVD entry is currently Analyzed. Evidence from the CVE record and NVD entry indicates a SQL Injection vulnerability in Piwigo's Activity List API endpoint, allowing an authenticated administrator to extract sensitive data. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-27885 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-27885

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-27885 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-27885

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.