CVE-2026-82482: coppermine-gallery Coppermine Photo Gallery edit_profile Endpoint profile.php cross site scripting
A security vulnerability has been detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28. This affects an unknown function of the file profile.php of the component editprofile Endpoint. The manipulation of the argument Biography leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.6.29 mitigates this issue. Upgrading the affected component is recommended.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
coppermine-gallery Coppermine Photo Gallery edit_profile Endpoint profile.phpto a version that resolves this vulnerability.Fixed in 1.6.29
Event History
Frequently Asked Questions
Which installations are affected?
Coppermine Photo Gallery versions up to and including 1.6.28 are affected. Version 1.6.29 mitigates the issue.
What does an attacker need to exploit this issue?
The attacker needs a user account with low-level privileges and must cause user interaction. Exploitation is remote and involves manipulating the Biography argument in the edit_profile endpoint in profile.php.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.
What should be done if the installation is affected?
Upgrade Coppermine Photo Gallery to version 1.6.29. The provided data does not identify an alternative mitigation for systems that cannot be upgraded immediately.