CVE-2026-44642

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 16.4.0

Description The check upgrade access rights() function in admin/include/functions upgrade.php conditionally escapes the submitted username only if the get magic quotes gpc function exists. In PHP 8 and later, where this function was removed, an unauthenticated username is concatenated directly into the upgrade authentication SQL query. If database upgrades are pending, a crafted query result can bypass status and password checks, set PHPWG IN UPGRADE, and allow the execution of upgrades without valid administrator credentials, potentially leading to unauthorized database integrity changes and service disruption.

Recommendations Update to version 16.4.0.