Coppermine Photo Gallery versions 1.6.09–1.6.27 contain an unauthenticated path traversal…
Coppermine Photo Gallery versions 1.6.09–1.6.27 contain an unauthenticated path traversal vulnerability allowing remote attackers to read arbitrary files; fixed in 1.6.28.
CERT Polska disclosed CVE-2026-3013, a path traversal vulnerability affecting Coppermine Photo Gallery versions 1.6.09 through 1.6.27. An unauthenticated remote attacker can exploit a vulnerable endpoint to construct payloads that read arbitrary files accessible to the web server process. The vulnerability requires no authentication, making it trivially exploitable by remote adversaries.
The issue has been remediated in version 1.6.28. Organizations running Coppermine Photo Gallery should upgrade immediately to the patched version. The vulnerability was responsibly disclosed by Jan Paweł Klim and coordinated through CERT Polska's vulnerability disclosure process.
Path traversal vulnerabilities in web applications commonly serve as initial access vectors or post-compromise enumeration mechanisms, allowing attackers to retrieve configuration files, application source code, or sensitive user data. Given the unauthenticated nature of this flaw, internet-facing Coppermine installations are at immediate risk of exploitation.
Mentioned in this report
Detection guidance
Potential Path Traversal Attempt Against Coppermine Photo Gallery
Detects HTTP requests containing directory traversal sequences targeting Coppermine Photo Gallery PHP endpoints, consistent with CVE-2026-3013 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Potential Path Traversal Attempt Against Coppermine Photo Gallery
id: 53f6c33f-6894-5d17-8fa7-0b935746268d
status: experimental
description: Detects web requests with directory traversal sequences (encoded or raw)
targeting Coppermine Photo Gallery PHP scripts, indicative of exploitation attempts
for CVE-2026-3013.
references:
- CVE-2026-3013
logsource:
category: webserver
detection:
selection_app:
cs-uri-stem|contains:
- .php
selection_traversal:
cs-uri-query|contains:
- ../
- ..\\
- '%2e%2e%2f'
- '%2e%2e/'
- ..%2f
- ..%252f
filter:
cs-uri-query|contains:
- lang=
- theme=
condition: selection_app and selection_traversal and not filter
falsepositives:
- Legitimate localization or theme parameters that happen to include relative path
segments
- Vulnerability scanners or pentest tools probing for traversal
level: high
tags:
- attack.t1190
- attack.initial_access
- cve.2026-3013
author: Vorant
Web Server Process Reading Sensitive OS Files Outside Webroot
Detects the web server process (e.g. Apache/PHP-FPM/IIS worker) accessing well-known sensitive system files typically retrieved via path traversal exploitation such as CVE-2026-3013. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Reading Sensitive OS Files Outside Webroot
id: 8e317f30-b987-595e-b00f-b34708bea165
status: experimental
description: Detects file reads of common sensitive system files (passwd, shadow,
boot.ini, win.ini, config files) by web server or PHP interpreter processes, suggesting
successful path traversal file disclosure following exploitation of vulnerabilities
like CVE-2026-3013 in Coppermine Photo Gallery.
references:
- CVE-2026-3013
logsource:
category: file_event
product: linux
detection:
selection_process:
Image|contains:
- /apache2/
- /httpd
- php-fpm
- nginx
selection_target:
TargetFilename|endswith:
- /etc/passwd
- /etc/shadow
- /etc/hosts
- win.ini
- boot.ini
condition: selection_process and selection_target
falsepositives:
- Legitimate administrative scripts or health-check tools reading system files for
monitoring purposes
- Backup or configuration-management agents running under the web server account
level: high
tags:
- attack.t1190
- attack.t1083
- cve.2026-3013
author: Vorant
Discovery Commands Spawned by Web Server Process Following Possible Exploitation
Detects file and directory discovery commands (ls, find, dir, cat) executed as child processes of a web server, which may indicate post-exploitation enumeration after a path traversal/file disclosure vulnerability such as CVE-2026-3013 was leveraged to gain code execution or shell access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Discovery Commands Spawned by Web Server Process Following Possible Exploitation
id: acf25651-43fc-59f0-a9a4-7bbd2dfb92f0
status: experimental
description: Detects common file/directory discovery commands executed with a web
server process (apache, nginx, php-fpm, httpd, w3wp) as parent, suggesting post-exploitation
enumeration following exploitation of an unauthenticated web application vulnerability
such as CVE-2026-3013.
references:
- CVE-2026-3013
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- /apache2/
- /httpd
- php-fpm
- nginx
selection_cmd:
Image|endswith:
- /ls
- /find
- /cat
- /whoami
- /id
condition: selection_parent and selection_cmd
falsepositives:
- Legitimate cron jobs or health-check scripts executed under the web server user
context
- Administrative maintenance tasks that shell out from web application code
level: medium
tags:
- attack.t1083
- attack.t1190
- cve.2026-3013
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/03/CVE-2026-3013
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free