CVE-2026-27834 | Piwigo up to 16.2.x List Web Service pwg.users.getList filter sql injection (GHSA-5jwg-cr5q-vjq2)

A vulnerability classified as critical was found in Piwigo up to 16.2.x. Affected is the function pwg.users.getList of the component List Web Service. Executing a manipulation of the argument filter can lead to sql injection.

This vulnerability is tracked as CVE-2026-27834. The attack can be launched remotely. No exploit exists.

Upgrading the affected component is advised.