CVE-2026-62262 Piwigo CVE debrief

Who should care

Defenders responsible for Piwigo installations, security teams, and administrators of web applications should be aware of this vulnerability and assess their exposure and potential impact.

Why it matters

CVE-2026-62262 is a critical vulnerability in Piwigo that allows unauthenticated guests to extract database information and cause database-dependent time delays. Defenders should prioritize verifying exposure and assessing potential impact on their systems.

• Potential extraction of database information
• Database-dependent time delays through the public search flow
• Verification of Piwigo installations for exposure
• Assessment of potential impact on systems using Piwigo

Technical summary

The vulnerability in Piwigo allows an unauthenticated guest to call pwg.images.filteredSearch.create with a crafted ratings[] value and then open the returned search URL. This stores the unvalidated value in the search rules and allows error-based or blind extraction of database information and database-dependent time delays through the public search flow. The vulnerability affects Piwigo versions 17.0.0beta1 and earlier. Defenders should prioritize verifying exposure of Piwigo installations to this vulnerability and assessing the potential impact on their systems.

Defensive priority

Defenders should prioritize verifying exposure of Piwigo installations to this vulnerability and assessing the potential impact on their systems.

Recommended defensive actions

• Verify Piwigo installations for exposure to this vulnerability
• Assess the potential impact on systems using Piwigo
• Monitor for potential exploitation attempts
• Consider implementing compensating controls to mitigate the vulnerability
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and vector. However, the corpus does not establish a fixed version or specific remediation steps. Defenders should verify Piwigo installations for exposure, assess potential impact, and monitor for exploitation attempts. The vulnerability allows unauthenticated guests to extract database information and cause database-dependent time delays through the public search flow. This is due to improper validation of user input in include/ws_functions/p

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.