Description

A security vulnerability has been detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28. This affects an unknown function of the file profile.php of the component edit_profile Endpoint. The manipulation of the argument Biography leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.6.29 mitigates this issue. Upgrading the affected component is recommended.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-08-30T07:17:22.000Z",
  "pubdate": "2026-08-30T07:17:22.000Z",
  "executiveSummary": "A stored cross-site scripting (XSS) vulnerability has been identified in Coppermine Photo Gallery versions up to 1.6.28.\nThe vulnerability resides within the profile editing functionality, specifically triggered via the 'Biography' input field in profile.php.\nBy injecting malicious JavaScript into the profile biography, an authenticated attacker can execute arbitrary scripts within the context of other users' sessions, including administrative sessions.\nThis vulnerability is remotely exploitable and poses a significant risk to user integrity and session security.\nSuccessful exploitation allows for unauthorized actions, session hijacking, or the distribution of malicious content to unsuspecting victims who view the compromised profile.\nThe vulnerability is fully addressed in Coppermine Photo Gallery version 1.6.29, and immediate upgrading is the recommended remediation path.",
  "technicalDetails": "The vulnerability is classified as a stored cross-site scripting (XSS) flaw located in the edit_profile component of Coppermine Photo Gallery, specifically affecting the profile.php file.\nThe root cause of the vulnerability is the improper neutralization of user-supplied input within the 'Biography' field during the profile update process. The application fails to perform adequate output encoding or sanitization before storing the biography text in the underlying database.\nWhen a user saves their profile with a crafted payload containing malicious JavaScript or HTML tags, the application persists this input without filtering. When other users—including administrators or moderators—access the affected user's profile, the application retrieves the malicious string from the database and renders it directly into the HTML document object model (DOM) of the victim's browser.\nThe attack flow proceeds as follows: 1) The attacker initiates an authenticated session and navigates to the edit profile interface. 2) The attacker submits a specially crafted payload via the 'Biography' input field. 3) The server-side code processes the request and saves the malicious script into the database record for the attacker's user profile. 4) A victim views the attacker's public profile page. 5) The browser parses the stored script as legitimate markup, executing the malicious code within the security context of the victim's session.\nBecause the payload is stored persistently in the database, the script executes every time the vulnerable profile page is requested, leading to widespread impact. This allows for several post-exploitation scenarios, including the theft of sensitive session cookies, CSRF (Cross-Site Request Forgery) attacks performed on behalf of the victim, redirection to malicious external domains, or the silent exfiltration of sensitive account data.\nThe vulnerability is remotely accessible and requires the attacker to have basic user-level access to the profile modification interface, making it a critical threat for installations that allow public registration. The persistence of the payload ensures that the attack is not limited to a single point in time, as the injected script will remain active until the profile is updated with sanitized content or the database is cleared."
}