CVE-2026-9059
Severity CVSS v4.0:
CRITICAL
Type:
CWE-89
SQL Injection
Publication date:
20/05/2026
Last modified:
20/05/2026
Description
NextGEN Gallery version prior to 4.2.1 are vulnerable to authenticated SQL injection via the &#39;orderby&#39; parameter on the REST API endpoints &#39;/imagely/v1/galleries&#39; and &#39;/imagely/v1/albums&#39;.<br />
<br />
<br />
<br />
The root cause is an insufficient sanitization function (&#39;_clean_column()&#39;) in the data mapper layer that uses a character blacklist instead of a whitelist approach. This allows an authenticated attacker with the &#39;NextGEN Gallery overview&#39; capability (assigned to the Administrator role by default) to inject arbitrary SQL into the &#39;ORDER BY&#39; clause.
Impact
Base Score 4.0
9.30
Severity 4.0
CRITICAL