Description
A security vulnerability has been detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28. This affects an unknown function of the file profile.php of the component edit_profile Endpoint. The manipulation of the argument Biography leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.6.29 mitigates this issue. Upgrading the affected component is recommended.
Published: 2026-08-30
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A stored cross‑site scripting flaw exists in the profile.php component of Coppermine Photo Gallery. User supplied input in the Biography field is rendered without proper sanitization, allowing an attacker to inject arbitrary JavaScript that runs in the browsers of anyone who views the affected profile. Such scripts can read cookies, steal session tokens, or perform unauthorized actions on behalf of the user, leading to privacy or credential compromise. The weakness is an input‑validation error classified as CWE‑79.

Affected Systems

The vulnerability affects all instances of Coppermine Photo Gallery versions up to and including 1.6.28. Upgrading to version 1.6.29 or later removes the flaw.

Risk and Exploitability

With a CVSS score of 5.1 the risk is moderate. The EPSS score is unavailable and it is not listed in CISA's KEV catalog. Based on the description, it is inferred that the attack can be initiated remotely by submitting crafted data to the Biography field, making the flaw potentially exploitable in environments where user input is not strictly controlled. Public disclosures and proofs of concept have been released, indicating that exploitation is feasible with moderate effort.

Generated by OpenCVE AI on August 30, 2026 at 07:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Coppermine Photo Gallery to version 1.6.29 or later, which implements proper input sanitization for the Biography field.
  • If an immediate upgrade is not possible, configure the application to strip or encode all HTML tags and special characters from the Biography input before storing or rendering it.
  • Deploy an application firewall rule or content security policy that blocks or alerts on suspicious script content posted to the Biography field, providing a temporary mitigation until the patch is applied.

Generated by OpenCVE AI on August 30, 2026 at 07:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 30 Aug 2026 06:30:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28. This affects an unknown function of the file profile.php of the component edit_profile Endpoint. The manipulation of the argument Biography leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.6.29 mitigates this issue. Upgrading the affected component is recommended.
Title coppermine-gallery Coppermine Photo Gallery edit_profile Endpoint profile.php cross site scripting
First Time appeared Coppermine-gallery
Coppermine-gallery coppermine Photo Gallery
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:*:*:*:*:*:*:*:*
Vendors & Products Coppermine-gallery
Coppermine-gallery coppermine Photo Gallery
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Coppermine-gallery Coppermine Photo Gallery
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-30T06:15:07.449Z

Reserved: 2026-08-29T16:07:07.744Z

Link: CVE-2026-82482

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-30T07:17:22.000

Modified: 2026-08-30T07:17:22.000

Link: CVE-2026-82482

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-30T08:00:05Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')