PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-35048 Piwigo CVE debrief

CVE-2026-35048 is a critical vulnerability in Piwigo versions 16.3.0 and earlier. The Piwigo installer accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization. On PHP 8+, the `addslashes()` protection is bypassed, allowing raw user input to be interpolated directly into PHP source code. An unauthenticated attacker can inject arbitrary PHP code through POST parameters, which gets written to `local/config/database.inc.php` and executed on every page load. This vulnerability has a high impact on affected systems and requires immediate attention.

Vendor
Piwigo
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-20
Original CVE updated
2026-07-21
Advisory published
2026-07-20
Advisory updated
2026-07-21

Who should care

Users of Piwigo versions 16.3.0 and earlier should be aware of this critical vulnerability and take immediate action to protect their installations. Affected operators should review and prioritize patching, while platform administrators should assess exposure and implement compensating controls. Vulnerability management and security teams should track exceptions and verify remediation.

Technical summary

The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization. On PHP 8+, the `addslashes()` protection is bypassed because it checks for `get_magic_quotes_gpc()`, a function removed in PHP 8.0. This allows raw user input to be interpolated directly into PHP source code. An unauthenticated attacker can inject arbitrary PHP code through POST parameters (prefix, dbpasswd, dbhost, dbname, or dbuser), which gets written to `local/config/database.inc.php` and executed on every page load.

Defensive priority

High

Recommended defensive actions

  • Update Piwigo to a version that is not vulnerable
  • Review and sanitize database configuration parameters
  • Monitor for suspicious activity on the Piwigo installation
  • Consider implementing additional security measures such as web application firewalls
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-20T17:17:06.840Z and was last modified on 2026-07-21T20:27:18.523Z. The NVD entry is currently Deferred. Evidence is limited, and defenders should verify the affected scope and severity with the vendor. The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-35048 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-35048

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-35048 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-35048

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.