CVE-2026-62262

Katalog CVE

CVSS 9.1 · Critical EPSS 0,30%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). Skor CVSS 3.1 9.1 (Critical) menurut github.com.

Deskripsi (NVD)

Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings[] value and then open the returned search URL. include/ws_functions/pwg.images.php stores the unvalidated value in the search rules, and include/functions_search.inc.php integer-casts only the lower rating bound while concatenating the raw value as the SQL upper bound. This allows error-based or blind extraction of database information and database-dependent time delays through the public search flow. No fixed version is available as of this review.

Rincian

Terbit di NVD

25 September 2026

Terakhir diubah

29 September 2026

Status NVD

Deferred

CVSS 3.1

9.1 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,30% peluang dieksploitasi; lebih tinggi dari 20,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/Piwigo/Piwigo/commit/9755d88edf38b94bafdedb0b3aba7304a94e2e5c
• https://github.com/Piwigo/Piwigo/commit/aede490a0b3a6c246f1f4689ca86c8fee377a7ae
• https://github.com/Piwigo/Piwigo/security/advisories/GHSA-hq29-8hhx-5jwc