CVE-2026-35048
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A vulnerability in the Piwigo installer versions 16.3.0 and earlier allows PHP code injection via POST parameters for database configuration. Lack of proper input sanitization and bypass of `addslashes()` on PHP 8+ enables an unauthenticated attacker to write malicious code into a configuration file, executed on every page load.
Risk Assessment
An attacker can gain full control over the server by executing arbitrary PHP code, leading to complete compromise of the application and potentially the entire system.
Recommendation
Immediately upgrade Piwigo to a version newer than 16.3.0 that includes a security fix. If an upgrade is not possible, restrict access to the installer and apply additional server-level protections.
Original NVD description (English source)
The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization. On PHP 8+, the `addslashes()` protection is bypassed because it checks for `get_magic_quotes_gpc()`, a function removed in PHP 8.0. This allows raw user input to be interpolated directly into PHP source code. An unauthenticated attacker can inject arbitrary PHP code through POST parameters (prefix, dbpasswd, dbhost, dbname, or dbuser), which gets written to `local/config/database.inc.php` and executed on every page load.