---
id: CVE-2026-44642
title: Piwigo is a full featured open source photo gallery application for the web
summary: >-
  Piwigo is a full featured open source photo gallery application for the web.
  Prior to 16.4.0, check_upgrade_access_rights() in
  admin/include/functions_upgrade.php conditionally escapes the submitted
  username only when the removed get_mag…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-89
vendor: Piwigo
product: Piwigo
affected:
  - Piwigo < 16.4.0
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T17:17:08.577'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-44642'
references:
  - url: >-
      https://github.com/Piwigo/Piwigo/commit/1ff9d04534feb5f8f3cc2d3613c0fe8b51a1c0ba
    label: security-advisories@github.com
  - url: >-
      https://github.com/Piwigo/Piwigo/commit/2cfa7a3d194c8b95edde43038d8f5be5a359e785
    label: security-advisories@github.com
  - url: 'https://github.com/Piwigo/Piwigo/releases/tag/16.4.0'
    label: security-advisories@github.com
  - url: 'https://github.com/Piwigo/Piwigo/security/advisories/GHSA-6wj3-7fhw-gfpm'
    label: security-advisories@github.com
  - url: 'https://github.com/Piwigo/Piwigo/security/advisories/GHSA-6wj3-7fhw-gfpm'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-25T16:40:38.942377Z'
ingestedAt: '2026-09-25T16:12:08.724Z'
epss: 0.01285
epssPercentile: 0.68939
---

## Overview

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, check_upgrade_access_rights() in admin/include/functions_upgrade.php conditionally escapes the submitted username only when the removed get_magic_quotes_gpc function exists, so PHP 8 and later concatenate an unauthenticated username directly into the upgrade authentication SQL query. When database upgrades are pending, a crafted query result can satisfy the status and password checks, set PHPWG_IN_UPGRADE, and authorize upgrade execution without valid administrator credentials. This can cause unauthorized database integrity changes and service disruption. This vulnerability is fixed in 16.4.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.