CVE-2026-27833

published 2026-04-03

CVE-2026-27833: Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the pwg.history.search API method in Piwigo is registered without the…

Priority P3 59 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

EXPLOIT

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the pwg.history.search API method in Piwigo is registered without the admin_only option, allowing unauthenticated users to access the full browsing history of all gallery visitors. This issue has been patched in version 16.3.0.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
piwigo	piwigo	< 16.3.0	16.3.0

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-862