CVE-2026-42323: Piwigo

High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days.

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/batch_manager.php accepts administrator-controlled dimension width, height, and ratio values and filesize values from the Batch Manager filter URL without numeric validation. The URL filter parser stores those values in the bulk_manager_filter session state, and later query construction concatenates them into SQL predicates, unlike the validated POST filter path. An authenticated administrator can use crafted filter values to execute time-based or other SQL expressions and potentially disclose, modify, or disrupt database data. This issue is fixed in version 16.4.0.

Affected products

• Piwigo Piwigo: before 16.4.0 (fixed in 16.4.0)

Published 2026-09-25. Last modified 2026-09-28.