Cyber Resilience

CVE-2026-27834

HighPublic PoC

Published: 03 April 2026

Published
03 April 2026
Modified
09 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0005 16.7th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-27834 is a high-severity SQL Injection (CWE-89) vulnerability in Piwigo Piwigo. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-27834 is a SQL injection vulnerability (CWE-89) in Piwigo, an open-source photo gallery web application. It affects versions prior to 16.3.0 and resides in the pwg.users.getList Web Service API method, where the filter parameter is directly concatenated into a SQL query without proper sanitization.

Authenticated administrators can exploit this vulnerability remotely with low attack complexity and no user interaction required. Successful exploitation allows execution of arbitrary SQL commands, resulting in high impacts to confidentiality, integrity, and availability, as reflected in its CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

The issue has been addressed in Piwigo version 16.3.0. Official mitigation guidance in the GitHub security advisory (GHSA-5jwg-cr5q-vjq2), the patching commit (9df471f16243371dc3725c5262e1632d23c8218a), and release notes at piwigo.org/release-16.3.0 recommends upgrading to the fixed version.

EU & UK References

Vulnerability details

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability exists in the pwg.users.getList Web Service API method. The filter parameter is directly concatenated into a SQL query without proper sanitization,…

more

allowing authenticated administrators to execute arbitrary SQL commands. This issue has been patched in version 16.3.0.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SQL injection in Piwigo's remotely accessible pwg.users.getList Web Service API method directly enables T1190 (Exploit Public-Facing Application) by allowing arbitrary SQL execution with no user interaction.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-27634Same product: Piwigo Piwigo
CVE-2026-27885Same product: Piwigo Piwigo
CVE-2026-27833Same product: Piwigo Piwigo
CVE-2024-48928Same product: Piwigo Piwigo
CVE-2026-39334Shared CWE-89
CVE-2024-13488Shared CWE-89
CVE-2026-20002Shared CWE-89
CVE-2025-1446Shared CWE-89
CVE-2025-22699Shared CWE-89
CVE-2026-36232Shared CWE-89

Affected Assets

piwigo
piwigo
≤ 16.3.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly mitigates SQL injection by requiring validation and sanitization of the filter parameter before concatenation into SQL queries in the pwg.users.getList API method.

SI-2 Flaw Remediation good match
prevent

Ensures timely remediation of the specific SQL injection flaw through patching to Piwigo version 16.3.0 or later.

RA-5 Vulnerability Monitoring and Scanning partial match
detect

Enables detection of SQL injection vulnerabilities like CVE-2026-27834 through regular vulnerability scanning of the web application.

References