CVE-2026-44642 Piwigo CVE debrief

Who should care

Defenders responsible for Piwigo deployments, particularly those with pending database upgrades, should assess exposure and apply the patch. This vulnerability can lead to unauthorized database changes and service disruption.

Why it matters

CVE-2026-44642 is a high-severity vulnerability in Piwigo that allows unauthorized database changes and service disruption. Defenders should prioritize verifying exposure and applying the patch, particularly in deployments with pending database upgrades.

• Unauthorized database integrity changes
• Service disruption due to pending upgrades
• Potential for crafted query results to bypass authentication
• Verification of exposure and patch application required

Technical summary

The check_upgrade_access_rights() function in admin/include/functions_upgrade.php conditionally escapes the submitted username only when the removed get_magic_quotes_gpc function exists. On PHP 8 and later, this allows an unauthenticated username to be concatenated directly into the upgrade authentication SQL query. When database upgrades are pending, a crafted query result can satisfy the status and password checks, set PHPWG_IN_UPGRADE, and authorize upgrade execution without valid administrator credentials.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, as this vulnerability can lead to unauthorized database changes and service disruption.

Recommended defensive actions

• Verify if Piwigo versions prior to 16.4.0 are in use and apply the patch
• Review database upgrades and authentication mechanisms for potential exposure
• Monitor for suspicious database changes and service disruptions
• Perform an inventory of assets using Piwigo to identify potential exposure
• Review system logs for signs of unauthorized database changes
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions and retest remediated assets after patch application

Evidence notes

The vulnerability is confirmed to exist in Piwigo versions prior to 16.4.0. The fix is available in version 16.4.0. However, the exact scope of affected deployments and potential impact requires further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.