CVE-2026-3013
HighSummary
Coppermine Photo Gallery versions 1.6.09 through 1.6.27 are vulnerable to path traversal. An unauthenticated remote attacker can exploit a vulnerable endpoint and construct payloads to read content of any file accessible by the web server process. The issue was fixed in version 1.6.28.
Risk Assessment
An attacker can read sensitive files such as configurations, passwords, or user data, leading to confidentiality breaches.
Recommendation
Update Coppermine Photo Gallery to version 1.6.28 or later. Restrict access to the application and monitor logs for suspicious requests.
Other vulnerabilities in Coppermine Photo Gallery
See all- CVE-2026-82483Low
A vulnerability was detected in Coppermine Photo Gallery up to 1.6.28, affecting the db_input.php file of the Hidden Album Update Endpoint. The manipulation results in cross site scripting. The attack can be launched remotely, and the exploit is public. Upgrading to version 1.6.29 fixes the issue.
- CVE-2026-82482Low
A vulnerability was detected in Coppermine Photo Gallery up to 1.6.28, affecting the profile.php file of the edit_profile Endpoint. Manipulating the Biography argument leads to cross site scripting. The attack can be initiated remotely, and the exploit has been publicly disclosed. Upgrading to version 1.6.29 mitigates the issue.
Original NVD description (English source)
Coppermine Photo Gallery in versions 1.6.09 through 1.6.27 is vulnerable to path traversal. Unauthenticated remote attacker is able to exploit a vulnerable endpoint and construct payloads that allow to read content of any file accessible by the the web server process.This issue was fixed in version 1.6.28.