CVE-2026-82482 coppermine-gallery CVE debrief

Who should care

System administrators and security teams responsible for Coppermine Photo Gallery installations, especially those using versions up to 1.6.28, should be aware of this vulnerability and take necessary defensive actions. This includes reviewing current deployments, restricting access to vulnerable endpoints, and implementing compensating controls where immediate upgrades are not feasible. Additionally, security teams should monitor for suspicious activities related to profile updates and ensure that input validation and output encoding are properly configured for the biography field in the profile.php endpoint.

Technical summary

The Coppermine Photo Gallery software up to version 1.6.28 contains a cross-site scripting (XSS) vulnerability in the profile.php endpoint. Specifically, the biography argument is vulnerable to stored XSS attacks. An attacker can remotely initiate the attack by manipulating the biography field. The vulnerability has been publicly disclosed and can be exploited. Upgrading to version 1.6.29 mitigates this issue. This type of vulnerability typically allows an attacker to inject malicious scripts into the profile pages of users, potentially leading to unauthorized actions or data breaches. Affected system administrators should prioritize upgrading to the patched version.

Defensive priority

Low-priority defensive review recommended due to limited attack surface and low CVSS score.

Recommended defensive actions

• Verify and inventory affected Coppermine Photo Gallery installations up to version 1.6.28
• Restrict write access to profile.php endpoint
• Implement input validation and output encoding for biography field
• Monitor for suspicious profile updates
• Upgrade to version 1.6.29 or later if possible
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The evidence for this CVE is limited, primarily based on official records from the CVE Program and NIST NVD. These sources indicate a cross-site scripting (XSS) vulnerability in Coppermine Photo Gallery up to version 1.6.28. The vulnerability is located in the profile.php endpoint and specifically affects the biography argument, allowing for stored XSS attacks. An attacker can remotely initiate the attack by manipulating the biography field. The vulnerability has been publicly disclosed, and upgrading to version 1.6.29 mitigates this issue. However, the exact scope of affected deployments and specific attack vectors are not detailed in the available records. Defenders should verify the presence of affected Coppermine Photo Gallery installations in their environments and review the official advisory for further guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.