CVE-2026-62262

Name of the Vulnerable Software and Affected Versions Piwigo versions 17.0.0beta1 and earlier

Description An unauthenticated guest can perform error-based or blind extraction of database information and trigger database-dependent time delays through the public search flow when rating is enabled. The issue occurs when the pwg.images.filteredSearch.create endpoint is called with a crafted ratings[] value. The file include/ws functions/pwg.images.php stores the unvalidated value in the search rules, and include/functions search.inc.php only integer-casts the lower rating bound, concatenating the raw value as the SQL upper bound.

Recommendations versions 17.0.0beta1 and earlier: At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, disable the rating feature to prevent the exploitation of this issue.