CVE-2026-82483
Received Received - Intake

Cross-Site Scripting in Coppermine Photo Gallery

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: VulDB

Description
A vulnerability was detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28. This impacts an unknown function of the file db_input.php of the component Hidden Album Update Endpoint. The manipulation results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used. Upgrading to version 1.6.29 will fix this issue. It is recommended to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-30
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-82483
EUVD
EUVD-2026-68170

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
coppermine-gallery coppermine_photo_gallery to 1.6.28 (inc)
coppermine-gallery coppermine_photo_gallery 1.6.29

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82483 is a stored cross-site scripting (XSS) vulnerability in Coppermine Photo Gallery versions up to 1.6.28. It allows a low-privilege authenticated user to exploit a hidden album update endpoint to inject malicious JavaScript into album descriptions they do not own. The vulnerability occurs because the backend handler in db_input.php fails to verify album ownership, only checking upload permissions. The injected payload is rendered unsafely using BBCode URL handling, enabling execution of arbitrary code in victims' browsers when the link is clicked.

Detection Guidance

Check for Coppermine Photo Gallery versions up to 1.6.28. Look for suspicious album descriptions containing JavaScript payloads like [url=javascript://a%0aalert(document.domain)]album-click[/url]. Review POST requests to db_input.php for unauthorized album metadata changes.

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript in the context of the application's origin. This can lead to session hijacking, theft of sensitive data, defacement of web pages, or delivery of malware to visitors. Users with normal registered accounts and upload rights can exploit it to target other users, including anonymous visitors, by modifying album descriptions.

Compliance Impact

This vulnerability allows stored cross-site scripting (XSS) attacks, which could enable attackers to inject malicious scripts into web pages. Such attacks may lead to unauthorized data access, modification, or theft, potentially violating GDPR's data protection requirements or HIPAA's safeguards for protected health information if user data is compromised.

Mitigation Strategies

Upgrade Coppermine Photo Gallery to version 1.6.29 or later. Remove or restrict access for low-privilege users with upload permissions until patched. Monitor album descriptions for unauthorized modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82483. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart