CVE-2026-82483: coppermine-gallery Coppermine Photo Gallery Hidden Album Update Endpoint db_input.php cross site scripting
A vulnerability was detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28. This impacts an unknown function of the file dbinput.php of the component Hidden Album Update Endpoint. The manipulation results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used. Upgrading to version 1.6.29 will fix this issue. It is recommended to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
coppermine-gallery Coppermine Photo Gallery Hidden Album Update Endpoint (db_input.php)to a version that resolves this vulnerability.Fixed in 1.6.29
Event History
Frequently Asked Questions
Which deployments are affected?
Coppermine Photo Gallery versions up to and including 1.6.28 are affected. The issue is associated with the Hidden Album Update Endpoint in db_input.php.
What does an attacker need to exploit this issue?
The attack can be launched remotely, but the CVSS vector indicates the attacker needs low-level privileges and user interaction. Public exploit code is available.
What should be done if the installation is affected?
Upgrade Coppermine Photo Gallery to version 1.6.29, which fixes the issue. The provided data does not identify an alternative mitigation for systems that cannot be upgraded immediately.
How can I determine whether my instance is vulnerable?
Check the installed Coppermine Photo Gallery version. Versions through 1.6.28 should be treated as affected; version 1.6.29 is identified as the fixed release.