CVE-2026-62262

Executive Summary

CVE-2026-62262 is a critical unauthenticated SQL injection (CWE-89) in Piwigo, a full-featured open-source photo gallery application for the web, affecting version 17.0.0beta1 and earlier. When the rating feature is enabled, an unauthenticated guest can invoke pwg.images.filteredSearch.create with a crafted ratings[] value and then open the returned search URL, causing unvalidated input to reach a SQL query as the upper bound. Successful exploitation permits extraction of database information and database-dependent time delays through the public search flow, with no fixed version available as of this review.

Technical Analysis

The vulnerability resides in the integration between the web-service layer and the search-rule builder. According to the NVD description, include/ws_functions/pwg.images.php stores the unvalidated ratings[] value supplied to pwg.images.filteredSearch.create into the persisted search rules. When the user subsequently opens the returned search URL, include/functions_search.inc.php processes those stored rules: it integer-casts only the lower rating bound while concatenating the raw value directly as the SQL upper bound. Because the upper bound is not parameterized or cast, attacker-controlled content is inserted into the SQL statement.

This is a classic second-order (stored) SQL injection pattern combined with a type-confusion-style partial validation flaw. The lower bound is sanitized by integer casting, but the upper bound is trusted verbatim. The vulnerability class is CWE-89, SQL Injection, and the attack surface is the public, unauthenticated web-service endpoint pwg.images.filteredSearch.create plus the public search flow that materializes the stored rules. The rating feature must be enabled for the vulnerable code path to be reachable — a configuration precondition, not an authentication requirement.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (score 9.1) reflects network reachability, low attack complexity, no privileges required, and no user interaction, with high confidentiality and integrity impact and no availability impact. The lack of a scoped change (S:U) indicates impact is confined to the Piwigo application and its backing database. The integrity impact is high because injected SQL can alter query semantics within the search flow; confidentiality impact is high because arbitrary database rows may be read. Availability is rated as none, though time-delay payloads indicate an attacker can induce database-dependent latency, which is a functional side effect rather than a persistent denial of service.

No public proof-of-concept, exploit code, or Nuclei template is available, and the CVE has not been added to CISA KEV. Patch confidence is 0/4: no fixed version, no vendor patch reference, and no workaround is documented.

Exploitation Scenarios

No public PoC exists for CVE-2026-62262; the attack chain below is inferred strictly from the vulnerability class and the mechanisms named in the NVD description. All identifiers used are those appearing verbatim in that description.

1. Reconnaissance / target identification. An attacker identifies internet-facing Piwigo installations at version 17.0.0beta1 or earlier where the rating feature is enabled. Fingerprinting can leverage characteristic Piwigo pages and the public web-service interface. No authentication is needed, so pre-auth enumeration of the web-service surface is sufficient.

2. Triggering the flaw class. The attacker calls the pwg.images.filteredSearch.create web service with a crafted ratings[] value. Per the description, include/ws_functions/pwg.images.php stores this unvalidated value into the search rules. The stored rule object is returned to the caller as a search URL, which the attacker then opens. Opening that URL causes include/functions_search.inc.php to process the stored rule, where the lower rating bound is integer-cast but the raw value is concatenated as the SQL upper bound. This mismatch is what permits injected SQL syntax to survive into the query.

3. Payload / execution method at the vulnerability-class level. Because the upper bound is concatenated unvalidated, the attacker supplies a ratings[] value containing SQL syntax designed for error-based or blind extraction. The description explicitly states the impact: error-based or blind extraction of database information and database-dependent time delays through the public search flow. Time-delay payloads allow an attacker to confirm injection and perform boolean/时间-based inference where error output is not returned.

4. Post-exploitation impact. With successful SQL injection, the attacker can read arbitrary database contents reachable by the application's database account — potentially including user records, session material, configuration values, and gallery metadata. Given the high integrity rating, the attacker may also influence query results within the search flow. Because exploitation is unauthenticated, no credential compromise or social engineering is required, making mass exploitation of exposed instances feasible. No exploit code is publicly available at this time, so broad opportunistic scanning is likely to follow only after weaponization.

Impact Assessment

Business impact is high. Piwigo deployments are frequently used for organizational photo archives, media libraries, and community galleries; a database compromise can expose user accounts, uploaded content metadata, and any secrets stored in the application database. The CVSS score of 9.1 with PR:N and UI:N means the vulnerability is exploitable by any network-reachable anonymous attacker without a session or victim interaction, which maximizes the exposed population. The blast radius is bounded by the application scope (S:U) but the confidentiality and integrity scores of High reflect the ability to read and influence the underlying database.

Affected systems are Piwigo installations running 17.0.0beta1 or earlier with the rating feature enabled. Because no fixed version exists, every qualifying deployment remains vulnerable until it is taken offline, network-restricted, or code-level mitigated. Public exposure combined with the absence of a patch elevates this to a priority remediation item for any internet-facing instance. The absence of an EPSS score and KEV listing means detection coverage must be driven by behavioral and network telemetry rather than threat-feed prioritization.

Detection Guidance

Sigma Rule

title: Piwigo Unauthenticated SQL Injection via ratings[] in filteredSearch.create
id: b6f1c2a4-3d9e-4f7b-9a01-62262cve2026
status: experimental
description: Detects requests invoking pwg.images.filteredSearch.create with SQL metacharacters in the ratings[] parameter, consistent with CVE-2026-62262.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-62262
author: valtersit.com
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-query|contains:
      - 'method=pwg.images.filteredSearch.create'
      - 'method=pwg.images.filteredSearch'
  selection_payload:
    cs-uri-query|contains:
      - 'ratings%5B%5D='
      - 'ratings[]='
  selection_sqli:
    cs-uri-query|contains:
      - "'"
      - '--'
      - 'sleep('
      - 'benchmark('
      - 'extractvalue('
      - 'updatexml('
      - 'union'
  condition: selection_endpoint and selection_payload and selection_sqli
falsepositives:
  - Legitimate clients submitting unusual rating bound values
level: high

YARA Rule

rule CVE_2026_62262_Piwigo_SQLi_Ratings
{
    meta:
        description = "Detects exploit traffic for CVE-2026-62262 targeting Piwigo ratings[] SQL injection"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-62262"
        author = "valtersit.com"
        date = "2026-01-01"
    strings:
        $ep1 = "pwg.images.filteredSearch.create" ascii nocase
        $ep2 = "pwg.images.filteredSearch" ascii nocase
        $p1 = "ratings[]=" ascii
        $p2 = "ratings%5B%5D=" ascii
        $s1 = "SLEEP(" ascii nocase
        $s2 = "BENCHMARK(" ascii nocase
        $s3 = "EXTRACTVALUE(" ascii nocase
        $s4 = "UPDATEXML(" ascii nocase
        $s5 = "UNION SELECT" ascii nocase
        $s6 = "--" ascii
    condition:
        (any of ($ep*)) and (any of ($p*)) and (any of ($s*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-62262 Piwigo ratings[] SQL Injection Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"pwg.images.filteredSearch.create"; nocase; http.uri; content:"ratings"; nocase; pcre:"/(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|UNION\s+SELECT)/i"; classtype:web-application-attack; reference:cve,2026-62262; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-62262; sid:202662262; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where event.category == "network" and
      url.query : "*pwg.images.filteredSearch.create*" and
      url.query : "*ratings*" ]
  [ network where event.category == "network" and
      url.query : ("*SLEEP(*" or "*BENCHMARK(*" or "*EXTRACTVALUE(*" or "*UPDATEXML(*" or "*UNION SELECT*") ]

Splunk SPL Query

index=web sourcetype=access_combined
(uri_query="*pwg.images.filteredSearch.create*" OR uri_query="*pwg.images.filteredSearch*")
(uri_query="*ratings*")
(uri_query="*SLEEP(*" OR uri_query="*BENCHMARK(*" OR uri_query="*EXTRACTVALUE(*" OR uri_query="*UPDATEXML(*" OR uri_query="*UNION*SELECT*" OR uri_query="*%27*")
| stats count min(_time) as first_seen max(_time) as last_seen values(clientip) as src_ips by uri_query
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="piwigo,web,sqli,">
  <rule id="2026620" level="12">
    <if_sid>31100</if_sid>
    <match>pwg.images.filteredSearch.create|pwg.images.filteredSearch</match>
    <match>ratings</match>
    <regex>(?i)(sleep\(|benchmark\(|extractvalue\(|updatexml\(|union\s+select|%27|--)</regex>
    <description>CVE-2026-62262: Possible Piwigo unauthenticated SQL injection via ratings[] in filteredSearch</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_62262,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 (UNPATCHED — no patch evidence from any tracked source). There is no fixed version and no documented workaround.

1. Immediate mitigations.

   • Disable the rating feature on Piwigo installations where it is not operationally required, since the vulnerable code path depends on rating being enabled.
   • Block or restrict access to the pwg.images.filteredSearch.create web service and the public search flow at the reverse proxy or WAF for untrusted networks.
   • Place internet-facing instances behind authentication or IP allowlisting until a fix is available.
   • Deploy the detection content in the previous section and alert on ratings[] values containing SQL metacharacters.

2. Patch/upgrade steps.

   • No fixed version is available as of this review. Track the Piwigo project for an official release addressing CVE-2026-62262 and upgrade immediately when published.
   • If a patch becomes available, validate that include/functions_search.inc.php parameterizes or correctly casts both rating bounds rather than concatenating the raw upper bound.

3. Long-term hardening.

   • Enforce parameterized SQL queries and strict integer validation for all search-rule bounds, including stored/second-order inputs.
   • Apply least-privilege database accounts for the Piwigo application to limit the impact of any SQL injection.
   • Enable centralized logging of all web-service requests and retain query strings for retroactive hunting.
   • Review any custom or third-party extensions that build search rules from user-supplied parameters.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-62262
• Piwigo project (vendor): https://piwigo.org/
• CWE-89: Improper Neutralization of Special Elements used in an SQL Command: https://cwe.mitre.org/data/definitions/89.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA KEV catalog status: NOT listed as of this review. No public PoC, exploit code, or tracked exploit-in-the-wild evidence is available for CVE-2026-62262.