OS Gallery (com_osgallery) below 6.2.7 - Unauthenticated SQL Injection via Public Search Module
CVE-2026-88854 (CVSS 9.3): showSearchResult() and showSearchResultAjax() in OrdaSoft's OS Gallery component before 6.2.7 read the textsearch/searchText request parameter with $input->getVar(), which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a LIKE clause with no escaping. The endpoint requires no login: it is reached via the public, commonly-published mod_osgallery_search search box, so any anonymous site visitor can inject a UNION SELECT and read arbitrary database content, including password hashes. Update to 6.2.7 or later.
Affected versions: < 6.2.7
Full advisory: www.cve.org
OS Gallery (com_osgallery) below 6.2.7 - Authenticated, Privileged Remote Code Execution and SQL Injection (3 CVEs)
OrdaSoft's OS Gallery component before 6.2.7 has three flaws exploitable by an authenticated user holding the core.manage permission on the gallery component (not administrator-wide trust). CVE-2026-88857 (CVSS 9.4): saveWatermark() writes an uploaded file to a web-accessible path using the client-supplied filename with no extension or content check, so a .php file disguised with an image Content-Type can be uploaded and executed directly. CVE-2026-88856 (CVSS 9.4): updateOSGallery(), reached via task=update_osgallery, passes a JSON request's method field to a live PHP function call using the package field as its argument, with no allow-list, reaching functions such as system, exec, shell_exec and passthru directly. CVE-2026-88855 (CVSS 8.6): saveGallery() concatenates category_names[], catOrderIds and image-ordering values into SQL with no quoting or integer cast, giving full read/write database access including UNION extraction of #__users password hashes. Update to 6.2.7 or later.
Affected versions: < 6.2.7
Full advisory: www.cve.org