CVE-2026-9059
CWE-89Published: May 20, 2026· Updated: May 20, 2026
Official Description
NextGEN Gallery version prior to 4.2.1 are vulnerable to authenticated SQL injection via the 'orderby' parameter on the REST API endpoints '/imagely/v1/galleries' and '/imagely/v1/albums'.
The root cause is an insufficient sanitization function ('_clean_column()') in the data mapper layer that uses a character blacklist instead of a whitelist approach. This allows an authenticated attacker with the 'NextGEN Gallery overview' capability (assigned to the Administrator role by default) to inject arbitrary SQL into the 'ORDER BY' clause.
Risk Analysis
This critical authenticated SQL injection vulnerability in NextGEN Gallery allows attackers to extract sensitive database information. With a CVSS score of 9.3, this flaw enables a highly privileged attacker to inject arbitrary SQL into the ORDER BY clause of REST API endpoints due to insufficient sanitization. This vulnerability is remotely exploitable.
No public exploit is currently known for this vulnerability. While it requires high privileges, its remote exploitability and potential for full database extraction make it a serious concern.
Upgrade NextGEN Gallery to version 4.2.1 or later to address the SQL injection vulnerability. Implement the principle of least privilege for all user accounts and ensure robust input sanitization is in place.
Technical Analysis
CVE-2026-9059 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
From a weakness classification perspective (CWE-89): SQL injection vulnerabilities allow attackers to manipulate database queries, potentially exposing or modifying sensitive data.
CVSS v3.1 Vector Breakdown
Exploit & PoC Resources
All References (1)
Quick Facts
Related CVEs (CWE-89)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-9059 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts