CVE-2026-82482
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A vulnerability was detected in Coppermine Photo Gallery up to 1.6.28, affecting the profile.php file of the edit_profile Endpoint. Manipulating the Biography argument leads to cross site scripting. The attack can be initiated remotely, and the exploit has been publicly disclosed. Upgrading to version 1.6.29 mitigates the issue.
Risk Assessment
The risk includes remote XSS attacks, potentially leading to user data theft or session hijacking.
Recommendation
It is recommended to upgrade to version 1.6.29 or later to fix the vulnerability.
Other vulnerabilities in Coppermine Photo Gallery
See all- CVE-2026-3013High
Coppermine Photo Gallery versions 1.6.09 through 1.6.27 are vulnerable to path traversal. An unauthenticated remote attacker can exploit a vulnerable endpoint and construct payloads to read content of any file accessible by the web server process. The issue was fixed in version 1.6.28.
- CVE-2026-82483Low
A vulnerability was detected in Coppermine Photo Gallery up to 1.6.28, affecting the db_input.php file of the Hidden Album Update Endpoint. The manipulation results in cross site scripting. The attack can be launched remotely, and the exploit is public. Upgrading to version 1.6.29 fixes the issue.
Original NVD description (English source)
A security vulnerability has been detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28. This affects an unknown function of the file profile.php of the component edit_profile Endpoint. The manipulation of the argument Biography leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.6.29 mitigates this issue. Upgrading the affected component is recommended.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS