A path traversal vulnerability exists in Coppermine Photo Gallery versions 1.6.09 through 1.6.27. An unauthenticated remote attacker can construct a request to a vulnerable endpoint, causing the web server to resolve directory traversal sequences and read arbitrary files that the web server process can access. The primary impact is the unauthorized disclosure of sensitive information that resides on the server, as the attacker can read any file permitted by the web server process, which may include configuration files, credentials, or other private data. This weakness is characterized as a classic path traversal issue (CWE-22).

The affected product is Coppermine Photo Gallery. All releases from 1.6.09 up to 1.6.27 are vulnerable. The issue was resolved in release 1.6.28.

The CVSS score for this vulnerability is 8.7, reflecting a high severity due to its remote nature and significant impact on confidentiality. The EPSS score is below 1%, indicating that, historically, exploitation is relatively rare, and the is not listed in the CISA KEV catalog. Nevertheless, because an unauthenticated attacker can read arbitrary files, the risk for organizations running the affected versions is substantial and should be mitigated promptly. The attack can be performed over standard HTTP requests and does not require special privileges or prior compromise.