Photoview through 2.4.0 SQL Injection via album download route
Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the album_id path segment. Attackers can supply crafted SQL expressions in the album_id parameter to extract arbitrary data from the database using time-based or blind injection techniques.
CVE-2026-96673
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-96673
Photoview
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/photoview/photoview",
"vendor": "Photoview",
"product": "Photoview",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom",
"lessThanOrEqual": "2.4.0"
},
{
"status": "unaffected",
"version": "deb1b216e047a30803dc0f48a9fc3d4c4abda594",
"versionType": "git"
}
],
"packageURL": "pkg:github/photoview/photoview",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-96673
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #9281 · Revision 1
- Added to Heist Feed
- Publisher date