A vulnerability described as critical has been identified in Piwigo up to 16.2.x. This affects the function
ws_std_image_sql_filter. Such manipulation of the argument f_min_date_available/f_max_date_available/f_min_date_created/f_max_date_created leads to sql injection.
This vulnerability is referenced as CVE-2026-27634. It is possible to launch the attack remotely. No exploit is available.
Upgrading the affected component is recommended.
