CVE-2026-96673

33th percentile - higher than 33% of all known CVEs

Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the album_id path segment. Attackers can supply crafted SQL expressions in the album_id parameter to extract arbitrary data from the database using time-based or blind injection techniques.

An unauthenticated attacker can read arbitrary data from the database, potentially including sensitive user and album information. This can lead to data leakage and confidentiality breaches.

Update Photoview to a version later than 2.4.0 if available, or apply patches that fix the SQL injection vulnerability. In the meantime, consider restricting access to the album download route.