CVE-2026-3013: Coppermine Gallery Path Traversal Flaw

CVE-2026-3013 Overview

Coppermine Photo Gallery versions 1.6.09 through 1.6.27 contain a path traversal vulnerability (CWE-22) that allows unauthenticated remote attackers to read arbitrary files accessible by the web server process. An attacker can exploit a vulnerable endpoint by constructing malicious payloads containing directory traversal sequences, enabling them to access sensitive configuration files, source code, or other critical system files outside the intended web root.

Critical Impact

Unauthenticated attackers can read any file accessible to the web server process, potentially exposing database credentials, configuration secrets, and sensitive application data.

Affected Products

• Coppermine Photo Gallery versions 1.6.09 through 1.6.27

Discovery Timeline

• 2026-03-11 - CVE-2026-3013 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-3013

Vulnerability Analysis

This path traversal vulnerability exists in Coppermine Photo Gallery's file handling mechanism. The application fails to properly validate and sanitize user-supplied input when processing file path parameters, allowing attackers to navigate outside the intended directory structure using sequences like ../ or encoded variations.

The vulnerability is exploitable remotely over the network without requiring authentication or user interaction. The impact is primarily on confidentiality, as attackers can read arbitrary files but cannot modify or delete them. Sensitive files commonly targeted in such attacks include database configuration files (e.g., config.inc.php), .htaccess files, and system files like /etc/passwd.

Root Cause

The root cause is insufficient input validation on file path parameters processed by the application. The vulnerable endpoint accepts user-controlled input that is incorporated into file system operations without adequate sanitization of directory traversal characters. This allows attackers to escape the web application's document root and access files elsewhere on the filesystem.

Attack Vector

The attack is conducted over the network by an unauthenticated remote attacker. The attacker identifies the vulnerable endpoint and crafts HTTP requests containing path traversal sequences (such as ../, ..%2f, or ..%5c) within the file path parameter. When processed, these sequences cause the application to traverse directories and return the contents of files outside the intended directory.

For example, an attacker might attempt to read configuration files containing database credentials or system files that reveal information about the server environment. The web server process's file system permissions determine which files can be accessed—typically any file readable by the web server user (e.g., www-data or apache).

Technical details and proof-of-concept information are available in the CERT Poland advisory.

Detection Methods for CVE-2026-3013

Indicators of Compromise

• HTTP requests containing path traversal sequences (../, ..%2f, %2e%2e/, ..%5c) in URL parameters or POST data
• Access log entries showing attempts to access sensitive files like /etc/passwd, config.inc.php, or wp-config.php
• Unusual file access patterns or errors in web server error logs indicating attempts to read files outside the document root
• Evidence of configuration file disclosure or leaked credentials

Detection Strategies

• Deploy web application firewall (WAF) rules to detect and block path traversal patterns in HTTP requests
• Configure intrusion detection systems (IDS) with signatures for common path traversal attack patterns
• Implement log analysis rules to alert on suspicious file path requests containing traversal sequences
• Monitor for anomalous file access patterns in application and system logs

Monitoring Recommendations

• Enable detailed access logging on web servers to capture full request URIs and parameters
• Set up alerting for repeated 403/404 errors that may indicate exploitation attempts
• Regularly review web application logs for path traversal indicators
• Implement real-time security monitoring for the Coppermine Photo Gallery application directory

How to Mitigate CVE-2026-3013

Immediate Actions Required

• Upgrade Coppermine Photo Gallery to version 1.6.28 or later immediately
• Review web server access logs for evidence of prior exploitation attempts
• Rotate any credentials stored in configuration files that may have been exposed
• Implement WAF rules to block path traversal patterns as an additional layer of defense

Patch Information

Coppermine Photo Gallery has addressed this vulnerability in version 1.6.28. Users should update to this version or later to remediate the issue. The patched release is available on GitHub.

For additional technical information, refer to the CERT Poland security advisory.

Workarounds

• Implement strict web application firewall rules to filter and block requests containing path traversal sequences
• Restrict file system permissions for the web server user to limit accessible files
• Use open_basedir PHP configuration directive to restrict file access to the application directory
• Consider temporarily disabling or restricting access to the vulnerable endpoint until patching is complete

# Example: Apache mod_rewrite rule to block path traversal attempts
RewriteEngine On
RewriteCond %{QUERY_STRING} (\.\./) [NC,OR]
RewriteCond %{QUERY_STRING} (\.\.%2f) [NC,OR]
RewriteCond %{QUERY_STRING} (%2e%2e/) [NC]
RewriteRule .* - [F,L]