Executive brief
Coppermine Photo Gallery is a popular open-source photo management application used to host and organize image galleries on websites. A low-privilege user can bypass access controls to modify album metadata belonging to other users and inject malicious JavaScript code into album descriptions. When visitors view public albums on the site, clicking the injected link executes arbitrary JavaScript in their browser, potentially leading to credential theft, session hijacking, or defacement.
Technical details
This is a stored cross-site scripting (XSS) vulnerability arising from two compounded weaknesses: insufficient authorization checking in the album update endpoint (db_input.php) and unsafe handling of user input when rendering album descriptions. A low-privilege authenticated user can POST to db_input.php with an album update request; the backend only verifies that the album exists and is public with uploads enabled (via user_is_allowed()), but fails to confirm the user owns the album. The attacker then injects malicious BBCode such as [url=javascript://...] into the description field. When album pages are rendered via index.php, the bb_decode() function processes this BBCode without validating URI schemes, allowing javascript: protocol handlers to be executed upon user interaction. The attack requires authentication and user interaction (clicking the link) but affects any visitor. Patches are available in version 1.6.29 and later.
Affected products
- Coppermine Gallery Coppermine Photo Gallery up to 1.6.28
Timeline
- 2026-08-30: disclosed
- 2026-04-27: patched: Fix released in version 1.6.29