CVE-2026-82482
LowCVSS 3.5Summary
A vulnerability was detected in Coppermine Photo Gallery up to 1.6.28, affecting the profile.php file of the edit_profile Endpoint. Manipulating the Biography argument leads to cross site scripting. The attack can be initiated remotely, and the exploit has been publicly disclosed. Upgrading to version 1.6.29 mitigates the issue.
Risk Assessment
The risk includes remote XSS attacks, potentially leading to user data theft or session hijacking.
Recommendation
It is recommended to upgrade to version 1.6.29 or later to fix the vulnerability.
Other vulnerabilities in Coppermine Photo Gallery
See all- CVE-2026-82483Low
A vulnerability was detected in Coppermine Photo Gallery up to 1.6.28, affecting the db_input.php file of the Hidden Album Update Endpoint. The manipulation results in cross site scripting. The attack can be launched remotely, and the exploit is public. Upgrading to version 1.6.29 fixes the issue.
- CVE-2026-3013High
Coppermine Photo Gallery versions 1.6.09 through 1.6.27 are vulnerable to path traversal. An unauthenticated remote attacker can exploit a vulnerable endpoint and construct payloads to read content of any file accessible by the web server process. The issue was fixed in version 1.6.28.
Original NVD description (English source)
A security vulnerability has been detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28. This affects an unknown function of the file profile.php of the component edit_profile Endpoint. The manipulation of the argument Biography leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.6.29 mitigates this issue. Upgrading the affected component is recommended.