{"id":"CVE-2026-96673","title":"Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the album_id path segment","summary":"Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the album_id path segment. Attackers can supply crafted SQL expressions in th…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-89"],"vendor":"Photoview","product":"Photoview","affected":["Photoview <= 2.4.0"],"published":"2026-09-23","updated":"2026-09-23","sourceUpdated":"2026-09-23T17:17:24.103","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96673","references":[{"url":"https://github.com/photoview/photoview","label":"disclosure@vulncheck.com"},{"url":"https://github.com/photoview/photoview/blob/v2.4.0/api/routes/downloads.go#L19-L29","label":"disclosure@vulncheck.com"},{"url":"https://github.com/photoview/photoview/commit/deb1b216e047a30803dc0f48a9fc3d4c4abda594","label":"disclosure@vulncheck.com"},{"url":"https://github.com/photoview/photoview/pull/1453","label":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@leediay/sqli-in-download-photoview","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/photoview-through-2.4.0-sql-injection-via-album-download-route","label":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@leediay/sqli-in-download-photoview","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-23T16:27:19.576482Z"},"ingestedAt":"2026-09-23T16:27:22.659Z","slug":"CVE-2026-96673","body":"## Overview\n\nPhotoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the album_id path segment. Attackers can supply crafted SQL expressions in the album_id parameter to extract arbitrary data from the database using time-based or blind injection techniques.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":209806,"id":"CVE-2026-96673","ts":1790184549726,"field":"exploit_available","old":"false","new":"true"}]}