CVE-2026-35048

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 16.3.1

Description The installer fails to properly sanitize POST parameters used for database configuration before writing them to a PHP configuration file. On PHP 8+, the protection mechanism is bypassed due to the removal of the get magic quotes gpc() function, allowing raw user input to be interpolated into PHP source code. An unauthenticated attacker can inject arbitrary PHP code via the prefix, dbpasswd, dbhost, dbname, or dbuser parameters, which is then written to the local/config/database.inc.php file and executed on every page load.

Recommendations Update to version 16.3.1 or later.