CVE-2026-42324

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 16.4.0

Description An authenticated administrator can store a crafted expression via the image order[] variable in the 'admin/element set ranks.php' endpoint because the application fails to enforce the sort-field whitelist. This stored expression is subsequently concatenated into ORDER BY clauses within 'admin/batch manager global.php', 'admin/batch manager unit.php', 'include/section init.inc.php', and 'include/ws functions/pwg.categories.php'. If at least one album contains at least one photo, this can be triggered during later album or Batch Manager queries to disclose, modify, or disrupt database data.

Recommendations Update to version 16.4.0.