Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-35048: Piwigo Installer Allows Arbitrary PHP Code Injection

CVE-2026-35048

Summary

Piwigo installers in versions 16.3.0 and earlier are vulnerable to code injection attacks. This means an attacker can inject malicious code into your website by sending special data to the installer. To fix this, update your Piwigo to the latest version, as the issue is resolved in later releases.

Original title

Original description

The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization. On PHP 8+, the `addslashes()` protection is bypassed because it checks for `get_magic_quotes_gpc()`, a function removed in PHP 8.0. This allows raw user input to be interpolated directly into PHP source code. An unauthenticated attacker can inject arbitrary PHP code through POST parameters (prefix, dbpasswd, dbhost, dbname, or dbuser), which gets written to `local/config/database.inc.php` and executed on every page load.

nvd CVSS3.1 9.8

Vulnerability type

CWE-20 Improper Input Validation

https://github.com/Piwigo/Piwigo/security/advisories/GHSA-gphq-34pv-gvf3

Published: 20 Jul 2026 · Updated: 20 Jul 2026 · First seen: 20 Jul 2026