CVE-2026-9059 | awesomemotive NextGEN Gallery up to 4.2.0 on REST REST API Endpoint /imagely/v1/albums _clean_column orderby sql injection

A vulnerability, which was classified as critical, was found in awesomemotive NextGEN Gallery up to 4.2.0 on REST. Impacted is the function _clean_column of the file /imagely/v1/albums of the component REST API Endpoint. The manipulation of the argument orderby results in sql injection.

This vulnerability is reported as CVE-2026-9059. The attack can be launched remotely. No exploit exists.

You should upgrade the affected component.