Executive brief
Coppermine Photo Gallery is a web-based photo management and sharing platform. A vulnerability in the user profile editor allows any registered user to inject malicious JavaScript code into their public biography that executes when other users view the profile. An attacker could use this to steal session cookies, redirect visitors to phishing sites, or perform actions on behalf of legitimate users.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the profile.php edit_profile endpoint. The vulnerability exists because the profile biography field accepts BBCode markup through the bb_decode() function in include/functions.inc.php, which fails to restrict dangerous URI schemes in [url=...] tags. An attacker can inject a malicious URL such as [url=javascript://a%0aalert(/XSS/)]click[/url], which is stored in the users database and rendered on the public profile page as a clickable JavaScript link. Any visitor who clicks the link will execute arbitrary JavaScript in the context of the Coppermine application. The vulnerability requires only a valid user account to exploit and affects all versions up to and including 1.6.28. A patch is available in version 1.6.29.
Affected products
- Coppermine Gallery Coppermine Photo Gallery up to 1.6.28
Timeline
- 2026-08-30: disclosed
- 2026-04-27: patched: Version 1.6.29 released with vulnerability mitigation