Coppermine Photo Gallery path traversal enables arbitrary file read
Coppermine Photo Gallery versions 1.6.09–1.6.27 contain an unauthenticated path traversal vulnerability allowing remote attackers to read arbitrary files; fixed in 1.6.28.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska disclosed CVE-2026-3013, a path traversal vulnerability affecting Coppermine Photo Gallery versions 1.6.09 through 1.6.27. An unauthenticated remote attacker can exploit a vulnerable endpoint to construct payloads that read arbitrary files accessible to the web server process. The vulnerability requires no authentication, making it trivially exploitable by remote adversaries.
The issue has been remediated in version 1.6.28. Organizations running Coppermine Photo Gallery should upgrade immediately to the patched version. The vulnerability was responsibly disclosed by Jan Paweł Klim and coordinated through CERT Polska's vulnerability disclosure process.
Path traversal vulnerabilities in web applications commonly serve as initial access vectors or post-compromise enumeration mechanisms, allowing attackers to retrieve configuration files, application source code, or sensitive user data. Given the unauthenticated nature of this flaw, internet-facing Coppermine installations are at immediate risk of exploitation.
Mentioned in this report
Detection guidance
Potential Path Traversal Attempt Against Coppermine Photo Gallery
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests containing directory traversal sequences targeting Coppermine Photo Gallery PHP endpoints, consistent with CVE-2026-3013 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Potential Path Traversal Attempt Against Coppermine Photo Gallery
id: 53f6c33f-6894-5d17-8fa7-0b935746268d
status: experimental
description: Detects web requests with directory traversal sequences (encoded or raw)
targeting Coppermine Photo Gallery PHP scripts, indicative of exploitation attempts
for CVE-2026-3013.
references:
- CVE-2026-3013
logsource:
category: webserver
detection:
selection_app:
cs-uri-stem|contains:
- .php
selection_traversal:
cs-uri-query|contains:
- ../
- ..\\
- '%2e%2e%2f'
- '%2e%2e/'
- ..%2f
- ..%252f
filter:
cs-uri-query|contains:
- lang=
- theme=
condition: selection_app and selection_traversal and not filter
falsepositives:
- Legitimate localization or theme parameters that happen to include relative path
segments
- Vulnerability scanners or pentest tools probing for traversal
level: high
tags:
- attack.t1190
- attack.initial-access
- cve.2026-3013
author: Vorant
Web Server Process Reading Sensitive OS Files Outside Webroot
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects the web server process (e.g. Apache/PHP-FPM/IIS worker) accessing well-known sensitive system files typically retrieved via path traversal exploitation such as CVE-2026-3013. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Reading Sensitive OS Files Outside Webroot
id: 8e317f30-b987-595e-b00f-b34708bea165
status: experimental
description: Detects file reads of common sensitive system files (passwd, shadow,
boot.ini, win.ini, config files) by web server or PHP interpreter processes, suggesting
successful path traversal file disclosure following exploitation of vulnerabilities
like CVE-2026-3013 in Coppermine Photo Gallery.
references:
- CVE-2026-3013
logsource:
category: file_event
product: linux
detection:
selection_process:
Image|contains:
- /apache2/
- /httpd
- php-fpm
- nginx
selection_target:
TargetFilename|endswith:
- /etc/passwd
- /etc/shadow
- /etc/hosts
- win.ini
- boot.ini
condition: selection_process and selection_target
falsepositives:
- Legitimate administrative scripts or health-check tools reading system files for
monitoring purposes
- Backup or configuration-management agents running under the web server account
level: high
tags:
- attack.t1190
- attack.t1083
- cve.2026-3013
author: Vorant
Discovery Commands Spawned by Web Server Process Following Possible Exploitation
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects file and directory discovery commands (ls, find, dir, cat) executed as child processes of a web server, which may indicate post-exploitation enumeration after a path traversal/file disclosure vulnerability such as CVE-2026-3013 was leveraged to gain code execution or shell access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Discovery Commands Spawned by Web Server Process Following Possible Exploitation
id: acf25651-43fc-59f0-a9a4-7bbd2dfb92f0
status: experimental
description: Detects common file/directory discovery commands executed with a web
server process (apache, nginx, php-fpm, httpd, w3wp) as parent, suggesting post-exploitation
enumeration following exploitation of an unauthenticated web application vulnerability
such as CVE-2026-3013.
references:
- CVE-2026-3013
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- /apache2/
- /httpd
- php-fpm
- nginx
selection_cmd:
Image|endswith:
- /ls
- /find
- /cat
- /whoami
- /id
condition: selection_parent and selection_cmd
falsepositives:
- Legitimate cron jobs or health-check scripts executed under the web server user
context
- Administrative maintenance tasks that shell out from web application code
level: medium
tags:
- attack.t1083
- attack.t1190
- cve.2026-3013
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/03/CVE-2026-3013
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs