Description

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability was discovered in Piwigo affecting the Activity List API endpoint. This vulnerability allows an authenticated administrator to extract sensitive data from the database, including user credentials, email addresses, and all stored content. This issue has been patched in version 16.3.0.

INFO

Published Date :

2026-04-03T21:36:07.360Z

Last Modified :

2026-04-03T21:36:07.360Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-27885 vulnerability.

No data.

REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-27885.

URL Resource
https://github.com/Piwigo/Piwigo/commit/c172d284e11eab4a5dbadd2844d26f734d5c8c72 cve-icon cve-icon
https://github.com/Piwigo/Piwigo/security/advisories/GHSA-wfmr-9hg8-jh3m cve-icon cve-icon
https://piwigo.org/release-16.3.0 cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact