Description

A vulnerability was detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28. This impacts an unknown function of the file db_input.php of the component Hidden Album Update Endpoint. The manipulation results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used. Upgrading to version 1.6.29 will fix this issue. It is recommended to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-08-30T08:16:33.560Z",
  "pubdate": "2026-08-30T08:16:33.560Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in Coppermine Photo Gallery versions up to 1.6.28. The flaw is located within the Hidden Album Update Endpoint in db_input.php.\nThis vulnerability allows remote, unauthenticated or authenticated attackers to inject malicious scripts into the application, which are then executed in the context of the victim's browser session.\nThe primary impact includes session hijacking, unauthorized actions performed on behalf of the user, and potential theft of sensitive information.\nThe risk is elevated due to the public availability of exploit code, necessitating an immediate upgrade to version 1.6.29 to eliminate the underlying security flaw.",
  "technicalDetails": "The vulnerability resides in the Hidden Album Update functionality within the db_input.php file of the Coppermine Photo Gallery component. The root cause is improper neutralization of user-supplied input before rendering it in the browser, which characterizes a classic reflected or stored Cross-Site Scripting (XSS) vector.\nThe attack flow initiates when an attacker sends a specially crafted HTTP request to the Hidden Album Update endpoint. By injecting malicious JavaScript payloads into fields processed by db_input.php, the application fails to perform adequate input validation or context-aware output encoding. When the affected page is rendered or updated, the browser interprets the injected payload as executable code rather than plain text.\nThe exploitation process typically involves an attacker crafting an URI or a POST request containing script tags (e.g., <script>alert(document.cookie)</script>) or other malicious HTML attributes. Because the application processes this input without sufficient sanitization, the server reflects the payload back to the user or stores it for subsequent viewings. When a victim, such as an administrator, accesses the compromised album settings or the corresponding page, the script executes within the security origin of the Coppermine installation.\nThis execution context grants the attacker the ability to perform actions on behalf of the victim, such as modifying gallery configurations, extracting session cookies to facilitate account takeover, or redirecting users to malicious third-party websites. Given that the exploit is currently public, threat actors can leverage automated tools to identify and target vulnerable instances of Coppermine Photo Gallery versions 1.6.28 and earlier. The vulnerability is exploitable remotely, does not necessarily require deep system-level access, and can be triggered via standard web interaction. The absence of strict Content Security Policy (CSP) headers or adequate input filtering in the affected component allows for the successful execution of these unauthorized scripts."
}