CVE-2026-42323: Unvalidated Batch Manager Filters Enable SQL Injection in Piwigo

Executive Summary

A SQL injection vulnerability tracked as CVE-2026-42323 has been disclosed in Piwigo, the open source photo gallery web application. The flaw carries a CVSS score of 7.2 (High) and lives in admin/batch_manager.php, where dimension (width, height, ratio) and filesize values supplied through the Batch Manager filter URL are accepted and stored without numeric validation.

Exploitation requires authenticated administrator access — the filter parameters flow through the URL-based filter path rather than the validated POST filter path, and the parser stores the raw values in the bulk_manager_filter session state before later query construction concatenates them directly into SQL predicates. An authenticated admin (or an attacker who has otherwise obtained admin session access) can use a crafted filter URL to trigger time-based blind SQL injection, potentially disclosing, modifying, or disrupting database contents. The issue is fixed in Piwigo 16.4.0.

Vulnerability Overview

Affected Versions

Attack Vector

1. Attacker obtains or already holds an authenticated administrator
   session on a Piwigo installation (credential compromise, session
   hijack, or malicious/compromised admin account)
2. Admin/attacker navigates to the Batch Manager filter URL instead of
   using the validated POST-based filter form, e.g.:
     GET /admin.php?page=batch_manager&filter=dimension-w1 AND SLEEP(10)..10
3. admin/batch_manager.php's URL filter parser (lines ~258-279) reads
   the width, height, ratio, and filesize values from the query string
   with NO numeric validation
4. The unvalidated values are written into the bulk_manager_filter
   PHP session state, persisting the malicious payload
5. Later query construction (lines ~535-556) concatenates the stored
   filter values directly into SQL predicates rather than using
   parameterized queries or the same validation applied to the POST path
6. The injected SQL expression executes against the database — a
   SLEEP()-based payload confirms time-based blind injection via
   measurable response delay
7. Attacker iterates blind boolean/time-based extraction to read,
   modify, or disrupt database contents (users, sessions, gallery
   metadata, configuration)

Impact of Successful Exploitation

Immediate Remediation

Step 1: Upgrade to Piwigo 16.4.0

# Back up the database and files before upgrading
mysqldump -u <user> -p <piwigo_db> > piwigo_backup_$(date +%F).sql
 
# Download and apply the 16.4.0 release per Piwigo's upgrade process
# (Administration > Update, or manual file replacement + admin/upgrade.php)

Confirm the installed version in Administration > General > About after upgrading, and verify it reports 16.4.0 or later.

Step 2: Restrict Admin Access in the Meantime

If immediate upgrade is not possible:

1. Limit administrator accounts to trusted personnel only, and enforce strong, unique passwords plus MFA where supported by your authentication front end.
2. Restrict access to admin.php at the web server or reverse proxy level (IP allowlisting, VPN-only access) to reduce exposure of the Batch Manager URL filter path.
3. Avoid using URL-based Batch Manager filters — use the standard POST-based filter form in the UI, which is not affected by this flaw.
4. Review admin session hygiene — shorten session lifetimes and rotate admin credentials if compromise is suspected.

Step 3: Review for Signs of Exploitation

# Search web server access logs for suspicious batch_manager filter requests
grep "page=batch_manager" /var/log/*/access.log | grep -Ei "sleep\(|benchmark\(|and |or |union|--|#"
 
# Look for abnormal response-time patterns on admin.php batch_manager requests
awk '$7 ~ /batch_manager/ {print $NF, $7}' /var/log/*/access.log

Detection Indicators

References

• NVD — CVE-2026-42323
• GitHub Security Advisory GHSA-7r67-9xhq-7p2c — SQL Injection in Batch Manager