CVE-2026-27833 Scanner

Piwigo is a widely-used open-source photo gallery software that enables users to create photoblogs and galleries for personal or community purposes. Developed by the Piwigo team, this software is popular among photographers, digital artists, and web administrators who wish to showcase images and manage photographic content. It features capabilities such as batch processing of photos, metadata storage, and versatile file management solutions. Piwigo is employed globally across personal projects and larger institutions seeking to implement a robust image-sharing platform. The software is known for its flexibility, ease of integration, and extensive plugin support.

This scanner detects an Information Disclosure vulnerability in Piwigo versions prior to 16.3.0. The vulnerability stems from improper access control in the pwg.history.search API method, which lacks appropriate restrictions. This flaw allows unauthenticated users to access complete browsing history details about visitors to a Piwigo gallery. Without requiring authentication, attackers can view potentially sensitive user activity data, raising concerns over privacy and security. This vulnerability necessitates attention due to the ease of exploitation.

Technical analysis reveals that the vulnerable endpoint is the pwg.history.search API method found at /ws.php. Parameters such as USERNAME and NB_LINES are vulnerable, enabling unauthorized access to user data. The endpoint should have enforced permissions, requiring admin-only access, which is currently misconfigured. As the API improperly handles requests from unauthenticated sources, attackers can access sensitive browsing records through crafted HTTP GET requests. Other fields like GUESTS are also exposed through the API, contributing to the risk footprint.

When exploited, this vulnerability can lead to severe effects such as exposure of user activity trends, browsing preferences, and other sensitive information. Cybercriminals capable of extracting this data may undertake subsequent attacks based on gathered insights. This could facilitate social engineering schemes, unauthorized profile alteration, or even blackmail using extracted personal data. Organizations and individuals running affected versions stand to experience privacy breaches and associated reputational harm unless mitigated.

REFERENCES

• https://github.com/Piwigo/Piwigo/security/advisories/GHSA-397m-gfhm-pmg2
• https://nvd.nist.gov/vuln/detail/CVE-2026-27833