Coppermine Gallery path traversal enables file read

11 March 2026 high vulnerability

Unauthenticated attackers can exploit CVE-2026-3013 in Coppermine Photo Gallery versions 1.6.09-1.6.27 to read arbitrary files via path traversal; patched in 1.6.28.

CERT Polska has coordinated disclosure of CVE-2026-3013, a path traversal vulnerability affecting Coppermine Photo Gallery versions 1.6.09 through 1.6.27. The flaw allows unauthenticated remote attackers to exploit a vulnerable endpoint and read arbitrary files accessible to the web server process.

The vulnerability requires no authentication and can be exploited remotely, presenting a significant risk to organizations running affected versions of the open-source photo gallery software. Administrators should upgrade to version 1.6.28, which addresses the issue.

The vulnerability was responsibly disclosed by researcher Jan Paweł Klim and coordinated through CERT Polska's vulnerability disclosure process. No evidence of active exploitation has been mentioned in the advisory.

Mentioned in this report

Vulnerabilities CVE-2026-3013

Detection guidance

Path Traversal Attempt Against Coppermine Photo Gallery Endpoint

ATT&CK T1190

Detects HTTP requests containing directory traversal sequences targeting Coppermine Photo Gallery PHP endpoints, indicative of CVE-2026-3013 exploitation attempts to read arbitrary files. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Path Traversal Attempt Against Coppermine Photo Gallery
id: e9c303c8-1d0d-5861-a8a0-630af7380a19
status: experimental
description: 'Detects web requests to Coppermine Photo Gallery PHP scripts that contain
  directory

  traversal sequences (e.g. ../ or encoded equivalents) in the query string, consistent

  with exploitation of CVE-2026-3013, an unauthenticated path traversal vulnerability

  allowing arbitrary file read.

  '
references:
- https://cert.pl
author: Vorant
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains:
    - displayimage.php
    - index.php
    - picmgr.php
    - edit.php
    - admin.php
  selection_traversal:
    cs-uri-query|contains:
    - ../
    - ..\\
    - '%2e%2e%2f'
    - '%2e%2e/'
    - ..%2f
    - '%252e%252e%252f'
  condition: selection_endpoint and selection_traversal
falsepositives:
- Vulnerability scanners or penetration testing tools probing the same endpoints
- Legitimate requests referencing file paths that coincidentally contain '..' sequences
  (rare)
level: high
tags:
- attack.t1190
- attack.initial-access

Web Server Process Reading Sensitive OS Files Outside Webroot

ATT&CK T1083

Detects a web server or PHP-CGI process opening sensitive system files (e.g. /etc/passwd, configuration files) that lie outside the expected webroot, consistent with successful exploitation of a path traversal vulnerability such as CVE-2026-3013 to enumerate and read arbitrary files. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Process Access to Sensitive Files Outside Webroot
id: d9ed0ab0-b11f-5e18-8e61-beb5d90e3e57
status: experimental
description: 'Detects a web server (Apache/Nginx/PHP-FPM/PHP-CGI) process opening
  or reading

  well-known sensitive system files located outside a typical web application root,

  which may indicate successful exploitation of a path traversal vulnerability

  such as CVE-2026-3013 in Coppermine Photo Gallery to perform arbitrary file read.

  '
references:
- https://cert.pl
author: Vorant
logsource:
  category: file_event
  product: linux
detection:
  selection_process:
    Image|endswith:
    - /httpd
    - /apache2
    - /nginx
    - /php-fpm
    - /php-cgi
  selection_target:
    TargetFilename|contains:
    - /etc/passwd
    - /etc/shadow
    - /etc/hosts
    - /etc/hostname
    - wp-config.php
    - .ssh/id_rsa
    - /proc/self/environ
  condition: selection_process and selection_target
falsepositives:
- System administration scripts run under the web server account for legitimate maintenance
- Backup or monitoring agents running as the web server user that read configuration
  files
level: medium
tags:
- attack.t1083
- attack.discovery

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/03/CVE-2026-3013

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free