VORANT. Threat Intelligence Sign in Get the full feed

Coppermine Photo Gallery Path Traversal Flaw Fixed

medium vulnerability

An unauthenticated path traversal vulnerability in Coppermine Photo Gallery lets remote attackers read arbitrary files, patched in version 1.6.28.

CERT Polska coordinated disclosure of CVE-2026-3013, a path traversal vulnerability affecting Coppermine Photo Gallery versions 1.6.09 through 1.6.27. The flaw allows an unauthenticated remote attacker to craft payloads against a vulnerable endpoint to read arbitrary files accessible to the web server process, potentially exposing configuration files, credentials, or other sensitive data hosted alongside the application.

The vulnerability was responsibly reported by researcher Jan Paweł Klim and coordinated through CERT Polska's standard disclosure process. The vendor has released version 1.6.28 to remediate the issue. There is no indication in the advisory of active exploitation in the wild; this is a standard vulnerability disclosure and patch notice.

Mentioned in this report

Vulnerabilities CVE-2026-3013

Related reporting

Detection guidance

Web Server Path Traversal Payload in HTTP Request

ATT&CK T1190

Detects HTTP requests containing path traversal sequences (../, ..\ variants) targeting web application endpoints, typical of CVE-2026-3013 exploitation attempts against Coppermine Photo Gallery. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Path Traversal Payload in HTTP Request
description: Detects HTTP requests with path traversal patterns (../, ..\, encoded
  variants) in URI or query parameters, typical of attacks against Coppermine Photo
  Gallery CVE-2026-3013 and similar path traversal vulnerabilities.
tags:
- attack.t1190
logsource:
  category: proxy
  product: proxy
detection:
  selection:
    http_request_uri|contains:
    - ../
    - ..\
    - '%2e%2e/'
    - '%2e%2e%5c'
    - ..%2f
    - ..%5c
  filter_known_safe:
    http_request_uri|contains:
    - /static/
    - /assets/
  condition: selection and not filter_known_safe
falsepositives:
- Security scanning tools and vulnerability assessors probing for path traversal
- Legitimate developer debugging with ../relative paths in query strings
- Web application testing frameworks sending crafted payloads
level: medium
id: c0f7d29d-e0b4-547f-889c-09e290c43101
status: experimental
author: Vorant

Web Server Access to Configuration and Credential Files via Path Traversal

ATT&CK T1190

Detects HTTP requests attempting to read sensitive configuration or credential files (e.g., config.php, .env, etc.) via path traversal patterns, consistent with CVE-2026-3013 post-authentication file disclosure. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Access to Configuration and Credential Files via Path Traversal
description: Detects HTTP requests using path traversal to access common configuration,
  credential, or sensitive files such as config.php, .env, web.config, or database
  configuration files, typical of CVE-2026-3013 exploitation.
tags:
- attack.t1190
logsource:
  category: proxy
  product: proxy
detection:
  selection_traversal:
    http_request_uri|contains:
    - ../
    - ..\
    - '%2e%2e/'
    - '%2e%2e%5c'
  selection_targets:
    http_request_uri|contains:
    - config.php
    - .env
    - web.config
    - database.yml
    - settings.ini
    - credentials
    - /etc/passwd
    - wp-config.php
  condition: selection_traversal and selection_targets
falsepositives:
- Authorized penetration testing against web applications
- Legitimate configuration file backup/restore workflows over HTTP
level: high
id: 57d34041-0750-5bca-bddf-c4d16f445c8a
status: experimental
author: Vorant

Coppermine Photo Gallery Vulnerable Endpoint Access Pattern

ATT&CK T1190

Detects HTTP requests targeting known Coppermine Photo Gallery endpoints with path traversal payloads, specifically matching the pattern of CVE-2026-3013 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Coppermine Photo Gallery Vulnerable Endpoint Access Pattern
description: Detects HTTP requests to Coppermine Photo Gallery endpoints combined
  with path traversal patterns, consistent with CVE-2026-3013 exploitation by unauthenticated
  attackers reading arbitrary files.
tags:
- attack.t1190
logsource:
  category: proxy
  product: proxy
detection:
  selection_coppermine:
    http_request_uri|contains:
    - /coppermine/
    - /gallery/
  selection_traversal:
    http_request_uri|contains:
    - ../
    - ..\
    - '%2e%2e/'
    - '%2e%2e%5c'
    - ..%2f
    - ..%5c
  condition: selection_coppermine and selection_traversal
falsepositives:
- Authorized security assessments of Coppermine installations
- Web vulnerability scanners configured to test Coppermine deployments
level: medium
id: c9923077-506b-517e-b6d8-b17c3c8b2e01
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/03/CVE-2026-3013

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free