CVE-2026-42323

Executive Summary

CVE-2026-42323 is a SQL injection vulnerability in Piwigo, an open-source web photo gallery application, affecting versions prior to 16.4.0. The flaw resides in the Batch Manager filter URL parsing path, where administrator-controlled numeric parameters (dimension width, height, ratio, and filesize) are stored in session state without validation and later concatenated directly into SQL predicates. Because exploitation requires an authenticated administrator account, the primary risk is privilege abuse, insider threat, and post-compromise escalation within an already-trusted administrative context, with high confidentiality, integrity, and availability impact (CVSS 7.2).

Technical Analysis

Piwigo's Batch Manager provides administrators with a filtered bulk-editing interface. The vulnerability lies in a divergence between two code paths that accept the same logical filter parameters:

1. POST filter path — values submitted via POST are validated before use (per the NVD description, this is the "validated POST filter path").
2. URL filter path — values supplied in the filter URL as dimension width, height, and ratio, plus filesize values, are accepted without numeric validation.

When the URL filter parser processes these values, it writes them into the bulk_manager_filter session variable. Later, query construction retrieves these session-stored values and concatenates them into SQL predicates rather than binding them as parameters. Because the values retain attacker-controlled strings, an administrator can inject SQL expression syntax into a position where the application expects a numeric literal.

The core weakness is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): an input-sanitization inconsistency between two entry points for the same data. The NVD description specifically characterizes the attacker capability as executing "time-based or other SQL expressions" — i.e., the injection point supports expression evaluation sufficient for boolean/time-based inference and potentially for data modification or disruption.

Notable characteristics:

• Trust boundary: The injection is gated behind administrator authentication. The flaw does not bypass the authentication check; it abuses the privileges of an already-authenticated high-privilege user.
• State persistence: Because the tainted values are written into session state (bulk_manager_filter), the malformed predicate may be re-used across multiple subsequent requests within the same session, widening the exploitation window beyond a single malicious request.
• Path asymmetry: The validated POST route demonstrates the developers were aware of the need to sanitize these parameters; the URL route was missed, indicating a maintenance/regression-class defect rather than an unknown-unknown.

No public proof-of-concept, Nuclei template, or exploit code was identified in the data provided. The specific SQL statement, table names, and concatenation site are not disclosed in the NVD description; this report therefore describes the mechanism at the vulnerability-class level and does not assert specific query structure beyond what is quoted above.

Exploitation Scenarios

The attack chain below is derived strictly from the NVD description; no PoC is public, and the chain is inferred from the SQL injection vulnerability class.

1. Reconnaissance / target identification An adversary identifies an internet- or intranet-exposed Piwigo installation running a version below 16.4.0. Standard fingerprinting of the photo gallery application and its administrative interface establishes the target. Access to an administrator account is a hard prerequisite — obtained via credential theft, phishing, password reuse, a shared administrative account, or a separate authentication bypass. No anonymous or low-privilege path is described for this CVE.

2. Triggering the flaw class Authenticated as an administrator, the attacker interacts with admin/batch_manager.php using the URL filter path and supplies crafted values for the width, height, ratio, or filesize filter parameters. Unlike the POST path, these URL-supplied values are not numerically validated. The parser writes the attacker-controlled strings into the bulk_manager_filter session state.

3. Payload / execution method (vulnerability-class level) On subsequent query construction, the session-stored values are concatenated into SQL predicates in a numeric-literal position. The attacker supplies SQL expression syntax in place of a numeric value. Consistent with the NVD description, an attacker can use this for time-based inference (injecting conditional delays to exfiltrate data bit-by-bit) or "other SQL expressions" that evaluate within the database engine. Because the injected content is persisted in session state, the tainted predicate can influence later requests from the same session.

4. Post-exploitation impact Successful exploitation permits disclosure of database contents (confidentiality), modification of stored data (integrity), and disruption or denial of service against the application/database (availability). Within a Piwigo deployment, the database can hold user credentials, email addresses, gallery metadata, and other administrative data. An attacker who already holds administrator rights could additionally use the confirmed injection as a stepping stone toward broader database or host compromise, depending on the DBMS configuration and application account permissions.

No exploit-in-the-wild activity, threat actor campaign, or KEV listing is associated with this CVE in the provided data. CISA KEV: NO.

Impact Assessment

CVSS v3.1 base score 7.2 (High) — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

• Attack Vector (Network): The vulnerable admin/batch_manager.php endpoint is reachable over the network. The attack does not require local or adjacent access.
• Attack Complexity (Low): No special conditions, race conditions, or memory-layout grooming are described; the flaw is a straightforward input-sanitization omission.
• Privileges Required (High): This is the primary mitigating factor. An authenticated administrator account is mandatory. This limits the exposed population to insider threats, compromised-admin-credential scenarios, and post-compromise lateral movement rather than anonymous mass exploitation.
• User Interaction (None): The administrator who triggers the injection is the attacker; no victim interaction is required.
• Scope (Unchanged): Impact remains within the security authority of the vulnerable component (the Piwigo application/database).
• Confidentiality / Integrity / Availability (High/High/High): The injection supports disclosure, modification, and disruption of database-resident data, mapping to high impact across all three CIA properties.

Business impact: Piwigo galleries frequently store sensitive image sets, embedded metadata, user accounts, and sometimes regulated content. A rogue or compromised administrator exploiting this flaw could exfiltrate user credential data (enabling further account compromise), tamper with or delete gallery records, and cause service disruption. Blast radius is bounded by the database account privileges used by Piwigo and by the number of installations where administrative credentials are shared, reused, or weakly protected. It does not, per the CVSS scope rating, directly imply compromise outside the application context, though DBMS-level escalation remains a possibility. This is classified as UNPATCHED by tracked sources (patch confidence 0/4); organizations should treat existing deployments below 16.4.0 as at-risk until upgrade is verified.

Detection Guidance

Sigma Rule

title: Piwigo Batch Manager SQL Injection via URL Filter Parameters
id: 6b9f2c1a-3d47-4e88-9a55-9c1e1c0b7e21
status: experimental
description: Detects access to admin/batch_manager.php with SQL-expression-like values in width, height, ratio, or filesize filter parameters via the URL query string, consistent with CVE-2026-42323.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-42323
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_path:
    cs-uri-stem|endswith: '/admin/batch_manager.php'
  selection_method:
    cs-method: 'GET'
  selection_injection:
    cs-uri-query|contains:
      - 'width='
      - 'height='
      - 'ratio='
      - 'filesize='
  selection_sql_meta:
    cs-uri-query|contains:
      - 'sleep('
      - 'benchmark('
      - 'waitfor'
      - 'select'
      - 'union'
      - '--'
      - '/*'
      - "'"
      - 'concat('
      - 'case when'
  condition: selection_path and selection_method and selection_injection and selection_sql_meta
fields:
  - c-ip
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Legitimate administrator filters containing unusual characters
  - Automated gallery-management scripts
level: high

YARA Rule

rule CVE_2026_42323_Piwigo_BatchManager_SQLi
{
    meta:
        description = "Detects SQL injection patterns in Piwigo batch_manager filter parameters (CVE-2026-42323) within web logs or request captures"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-42323"
        cve = "CVE-2026-42323"

    strings:
        $batch = "batch_manager.php" ascii wide nocase
        $p1 = "width=" ascii wide nocase
        $p2 = "height=" ascii wide nocase
        $p3 = "ratio=" ascii wide nocase
        $p4 = "filesize=" ascii wide nocase

        $sqli1 = "sleep(" ascii nocase
        $sqli2 = "benchmark(" ascii nocase
        $sqli3 = "waitfor delay" ascii nocase
        $sqli4 = "union select" ascii nocase
        $sqli5 = "case when" ascii nocase
        $sqli6 = "concat(" ascii nocase

    condition:
        $batch and any of ($p*) and any of ($sqli*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-42323 Piwigo batch_manager.php SQL Injection via URL Filter (Potential)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/admin/batch_manager.php"; nocase; http.uri; content:"width="; nocase; http.uri; pcre:"/(sleep|benchmark|waitfor|union%20select|case%20when|concat)\(?/i"; reference:cve,CVE-2026-42323; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-42323; classtype:web-application-attack; sid:2026423230; rev:1;)

Elastic Detection

sequence by source.ip, user.name with maxspan=30m
  [ url.path == "/admin/batch_manager.php" and url.query : ("*width=*" or "*height=*" or "*ratio=*" or "*filesize=*") ]
  [ url.path == "/admin/batch_manager.php" and url.query : ("*sleep(*" or "*benchmark(*" or "*union*" or "*case when*" or "*concat(*" or "*--*") ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:plus:access
| search uri_path="*/admin/batch_manager.php*" method=GET
| eval q=lower(uri_query)
| where (match(q,"width=") OR match(q,"height=") OR match(q,"ratio=") OR match(q,"filesize="))
    AND (match(q,"sleep\(") OR match(q,"benchmark\(") OR match(q,"waitfor") OR match(q,"union") OR match(q,"case\+when") OR match(q,"concat\(") OR match(q,"--"))
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_query) as queries by src_ip, user
| sort - count

Wazuh OSSEC Rule

<group name="web,piwigo,sqli,">
  <rule id="2026423" level="12">
    <if_sid>31100</if_sid>
    <id>^334</id>
    <match>batch_manager.php</match>
    <regex>(width|height|ratio|filesize)=.*(sleep\(|benchmark\(|waitfor|union|case when|concat\(|--)</regex>
    <description>Piwigo batch_manager.php SQL injection attempt via URL filter parameters (CVE-2026-42323)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_42323,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in Piwigo 16.4.0, but no tracked patch source, vendor advisory, or OSV package record was available to independently confirm the fix. Treat remediation status as unverified until the vendor confirms.

1. Immediate mitigations (while patch status is unverified)

   • Restrict access to admin/batch_manager.php and the administrative interface to trusted networks via web-server ACLs, VPN, or WAF rules; do not expose the admin panel to the public internet.
   • Enforce the principle of least privilege on administrative accounts: unique, strong credentials, MFA, and prompt rotation of any shared admin account.
   • Deploy WAF rules that reject SQL metacharacters (quotes, parentheses, comment markers, sleep/benchmark/waitfor tokens) in the width, height, ratio, and filesize filter parameters passed via URL.
   • Monitor-and-alert on the detection content in the section above; the session-persistence behavior means repeat hits from one session may indicate active exploitation.
   • Reduce the Piwigo database account to minimum required privileges (no DDL, no file-write, no broad cross-schema access) to limit blast radius if injection occurs.

2. Patch / upgrade steps

   • Upgrade Piwigo to 16.4.0 or later if the vendor's release notes confirm it remediates CVE-2026-42323 (per NVD description, 16.4.0 is the fixed version). Validate the artifact's provenance/checksum before deployment and test on a staging instance.
   • Because patch confidence is 0/4, verify the changelog explicitly references this CVE; if it does not, assume the code path remains vulnerable and retain compensating controls.
   • Back up the database and application files before upgrading, and confirm the bulk_manager_filter session handling no longer concatenates unvalidated input post-upgrade.

3. Long-term hardening

   • Eliminate the input-validation asymmetry between POST and URL filter paths; centralize numeric validation/casting for width, height, ratio, and filesize at a single trusted entry point.
   • Adopt parameterized queries / prepared statements universally and forbid string concatenation into SQL predicates in code review and CI checks.
   • Avoid persisting raw user-supplied filter values into session state; store normalized, typed values only.
   • Implement continuous dependency and CVE monitoring for the Piwigo deployment, plus routine admin credential hygiene audits.

References

• NVD — CVE-2026-42323: https://nvd.nist.gov/vuln/detail/CVE-2026-42323
• Piwigo project homepage / release notes (verify 16.4.0 fix): https://piwigo.org/
• MITRE CWE-89 — Improper Neutralization of Special Elements used in an SQL Command: https://cwe.mitre.org/data/definitions/89.html
• FIRST EPSS (no score published as of this report; monitor): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-42323 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild evidence: none identified in the provided data. CISA KEV: NO. No public PoC, Nuclei template, or exploit code was available at the time of writing.