In regards to CVE-2026-72550: @ admins @ developers @

In regards to CVE-2026-72550: @admins @developers @helpers

I have applied a hotfix to mod/photos.php starting around line 673 on my Friendica 'Blutwurz' 2026.08-dev - 1598 instance to mitigate the unauthenticated SQL injection vulnerability via the order query parameter.

Requesting a review from core devs—if this is a viable patch approach, please feel free to push a similar fix upstream to help administrators secure their instances!

Original Code:

if ($cmd === 'view' && !DI::config()->get('system', 'no_count', false)) {
	$order_field =$_GET['order'] ?? '';

	if ($order_field === 'created') {
		$params = ['order' => [$order_field]];
	} elseif (!empty($order_field) && DBStructure::existsColumn('photo', [$order_field])) {
		$params = ['order' => [$order_field => true]];
	} else {
		$params = [];
	}

Patched Code (Strict Whitelist Validation):

if ($cmd === 'view' && !DI::config()->get('system', 'no_count', false)) {
	// Whitelist allowed order fields to prevent SQL injection (CVE-2026-72550)
	$allowed_orders = ['created', 'edited', 'title', 'album', 'filename', 'id'];
	$order_field =$_GET['order'] ?? '';

	if (!in_array($order_field, $allowed_orders, true)) {$order_field = 'created';
	}

	if ($order_field === 'created') {
		$params = ['order' => [$order_field]];
	} elseif (!empty($order_field) && DBStructure::existsColumn('photo', [$order_field])) {
		$params = ['order' => [$order_field => true]];
	} else {
		$params = [];
	}