CVE-2026-27885

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-27885

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27885.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-27885

Aliases

GHSA-wfmr-9hg8-jh3m

Published

2026-04-03T21:36:07.360Z

Modified

2026-07-27T03:56:42.156993215Z

Severity

7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Piwigo: SQL Injection in Activity.getList

Details

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability was discovered in Piwigo affecting the Activity List API endpoint. This vulnerability allows an authenticated administrator to extract sensitive data from the database, including user credentials, email addresses, and all stored content. This issue has been patched in version 16.3.0.

Database specific

{
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27885.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/piwigo/piwigo

Affected ranges

Type

GIT

Repo

https://github.com/piwigo/piwigo

Events

Introduced

Fixed

69f1f76192e6e692f575a5f79c194655dee2d5ca

Fixed

c172d284e11eab4a5dbadd2844d26f734d5c8c72

Database specific

{
    "cpe": "cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "16.3.0"
        }
    ]
}

Affected versions

12.*

12.0.0RC1

12.0.0RC2

12.0.0beta1

12.0.0beta2

13.*

13.0.0RC1

13.0.0RC2

13.0.0RC3

13.0.0RC4

13.0.0beta1

13.0.0beta2

14.*

14.0.0RC1

14.0.0RC2

14.0.0beta1

14.0.0beta2

14.0.0beta3

15.*

15.0.0beta1

15.0.0beta2

15.0.0beta3

16.*

16.0.0

16.0.0RC1

16.0.0RC2

16.0.0RC3

16.0.0beta1

16.0.0beta2

16.1.0

16.2.0

2.*

2.10.0RC1

2.10.0beta1

2.10.0beta2

2.11.0beta1

2.11.0beta2

2.11.0beta3

2.11.0beta4

2.8.0RC1

2.8.0RC2

2.9.0RC1

2.9.0RC2

2.9.0beta1

2.9.0beta2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27885.json"