CVE-2026-82483
LowCVSS 3.5Summary
A vulnerability was detected in Coppermine Photo Gallery up to 1.6.28, affecting the db_input.php file of the Hidden Album Update Endpoint. The manipulation results in cross site scripting. The attack can be launched remotely, and the exploit is public. Upgrading to version 1.6.29 fixes the issue.
Risk Assessment
The risk includes remote XSS attacks, potentially leading to user data theft or session hijacking.
Recommendation
It is recommended to upgrade to version 1.6.29 or later immediately to fix the vulnerability.
Other vulnerabilities in Coppermine Photo Gallery
See all- CVE-2026-82482Low
A vulnerability was detected in Coppermine Photo Gallery up to 1.6.28, affecting the profile.php file of the edit_profile Endpoint. Manipulating the Biography argument leads to cross site scripting. The attack can be initiated remotely, and the exploit has been publicly disclosed. Upgrading to version 1.6.29 mitigates the issue.
- CVE-2026-3013High
Coppermine Photo Gallery versions 1.6.09 through 1.6.27 are vulnerable to path traversal. An unauthenticated remote attacker can exploit a vulnerable endpoint and construct payloads to read content of any file accessible by the web server process. The issue was fixed in version 1.6.28.
Original NVD description (English source)
A vulnerability was detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28. This impacts an unknown function of the file db_input.php of the component Hidden Album Update Endpoint. The manipulation results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used. Upgrading to version 1.6.29 will fix this issue. It is recommended to upgrade the affected component.