CVE-2026-62262 — Piwigo: Unauthenticated SQL injection in `pwg.images.filteredSearch.create`
Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can call pwg.images.fil…
Published: 2026-09-25 · CVSS: 9.1 · CVSS 3.1
Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings[] value and then open the returned search URL. include/ws_functions/pwg.images.php stores the unvalidated value in the search rules, and include/functions_search.inc.php integer-casts only the lower rating bound while concatenating the raw value as the SQL upper bound. This allows error-based or blind extraction of database information and database-dependent time delays through the public search flow. No fixed version is available as of this review.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7