CVE-2026-27634

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the four date filter parameters (f_min_date_available, f_max_date_available, f_min_date_created, f_max_date_created) in ws_std_image_sql_filter() are concatenated directly into SQL without any escaping or type validation. This could result in an unauthenticated attacker reading the full database, including user password hashes. This issue has been patched in version 16.3.0.

• CWE-89

• https://github.com/Piwigo/Piwigo/commit/0d5ed1f7778bbe263410446d8cf64594df75bd08Patch
• https://github.com/Piwigo/Piwigo/security/advisories/GHSA-mgqc-3445-qghqExploit, Vendor Advisory
• https://piwigo.org/release-16.3.0Release Notes

Published

Apr 3, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27629InvenTree is an Open Source Inventory Management System. Pri…8.8
• CVE-2026-2763Use-after-free in the JavaScript Engine component. This vuln…9.8
• CVE-2026-27630TinyWeb is a web server (HTTP, HTTPS) written in Delphi for …7.5
• CVE-2026-27631Exiv2 is a C++ library and a command-line utility to read, w…5.3
• CVE-2026-27632Talishar is a fan-made Flesh and Blood project. Prior to com…3.1
• CVE-2026-27633TinyWeb is a web server (HTTP, HTTPS) written in Delphi for …7.5
• CVE-2026-27635Manyfold is an open source, self-hosted web application for …8.8
• CVE-2026-27636FreeScout is a free help desk and shared inbox built with PH…8.8
• CVE-2026-27637FreeScout is a free help desk and shared inbox built with PH…9.8
• CVE-2026-27638Actual is a local-first personal finance tool. Prior to vers…7.1
• CVE-2026-27639Mercator is an open source web application designed to enabl…5.4
• CVE-2026-2764JIT miscompilation, use-after-free in the JavaScript Engine:…9.8