CVE-2026-35048
A critical flaw in the Piwigo installer allows attackers to inject PHP code via POST parameters, which is then executed on every page load. The vulnerability exists in Piwigo 16.3.0 and earlier.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Piwigo image gallery software, installer versions 16.3.0 and earlier, typically used by website administrators hosting photo galleries.
Real-world impact
An attacker can run arbitrary PHP code on the server, giving them full control over the site, data, and potentially the underlying server.
Why this severity
The CVSS score of 9.8 reflects that the flaw is exploitable without authentication, has no user interaction, and can compromise confidentiality, integrity, and availability of the entire application.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources