CVE-2023-26876

Deeper analysis

Piwigo versions 13.5.0 and earlier contain an SQL injection vulnerability tracked as CVE-2023-26876. The flaw resides in the filter_user_id parameter accepted by the admin.php?page=history endpoint and is classified under CWE-89. With a CVSS 3.1 score of 8.8, the issue permits remote attackers to influence backend SQL queries and ultimately execute arbitrary code on the server.

An attacker who already possesses a low-privileged account with access to the administrative history page can supply a crafted filter_user_id value to trigger the injection. Successful exploitation grants full read, write, and execute capabilities on the affected database and host, satisfying the high impact ratings across confidentiality, integrity, and availability.

The current EPSS of 0.54 indicates moderate but non-negligible exploitation interest following disclosure, with no material upward trajectory observed after the initial peak. Public references include proof-of-concept code and a full-disclosure mailing-list post, while the vendor site offers no additional mitigation details in the supplied references.