CVE-2026-96673

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-96673
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96673.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-96673
Published
2026-09-23T15:35:10Z
Modified
2026-09-26T03:30:44Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Photoview through 2.4.0 SQL Injection via album download route
Details

Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the album_id path segment. Attackers can supply crafted SQL expressions in the album_id parameter to extract arbitrary data from the database using time-based or blind injection techniques.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-89"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96673.json"
}
References

Affected packages

Git / github.com/photoview/photoview

Affected ranges

Type
GIT
Repo
https://github.com/photoview/photoview
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f79d379e38241c687c55e9f899e30661fd9f115a
Fixed
deb1b216e047a30803dc0f48a9fc3d4c4abda594
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.4.0"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.0
v1.0.1
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v2.*
v2.0.0
v2.0.1
v2.1.0
v2.1.1
v2.2.0
v2.2.1
v2.3.0
v2.3.1
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.2
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
v2.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96673.json"