CVE-2026-42323 Piwigo CVE debrief

Who should care

Piwigo administrators and users should be aware of this vulnerability and take steps to mitigate it. Piwigo administrators and users should prioritize upgrading to version 16.4.0 to mitigate this vulnerability. The vulnerability can be mitigated by upgrading to version 16.4.0 or later, restricting access to the Batch Manager filter URL, and monitoring database activity for suspicious SQL queries.

Why it matters

CVE-2026-42323 is a high-severity vulnerability in Piwigo that allows an authenticated administrator to execute SQL expressions and potentially disclose, modify, or disrupt database data. Piwigo administrators and users should prioritize upgrading to version 16.4.0 to mitigate this vulnerability.

• Potential disclosure of database data
• Potential modification of database data
• Potential disruption of database data
• Verification of database integrity and security

Technical summary

The vulnerability is caused by the lack of numeric validation for administrator-controlled dimension width, height, and ratio values and filesize values from the Batch Manager filter URL. This allows an authenticated administrator to execute time-based or other SQL expressions and potentially disclose, modify, or disrupt database data. The vulnerability can be mitigated by upgrading to version 16.4.0 or later, restricting access to the Batch Manager filter URL, and monitoring database activity for suspicious SQL queries. Piwigo administrators and users should prioritize upgrading to version 16.4.0 to mitigate this vulnerability.

Defensive priority

Piwigo administrators and users should prioritize upgrading to version 16.4.0 to mitigate this vulnerability.

Recommended defensive actions

• Upgrade Piwigo to version 16.4.0 or later
• Restrict access to the Batch Manager filter URL
• Monitor database activity for suspicious SQL queries
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the lack of numeric validation for administrator-controlled dimension width, height, and ratio values and filesize values from the Batch Manager filter URL. This allows an authenticated administrator to execute time-based or other SQL expressions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.