Path Traversal in Coppermine Photo Gallery
CVE-2026-3013
Coppermine Photo Gallery in versions 1.6.09 through 1.6.27 is vulnerable to path traversal. Unauthenticated remote attacker is able to exploit a vulnerable endpoint and construct payloads that allow to read content of any file accessible by the the web server process.This issue was fixed in version 1.6.28.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.005 (41.8th percentile) — read the EPSS interpretation.
Affected products
- Coppermine Photo Gallery — versions 1.6.09