# Coppermine Photo Gallery versions 1.6.09–1.6.27 contain an unauthenticated path traversal…

Published: 2026-03-11 · Severity: high
Canonical: https://vorant.io/reports/b2869d0b-24d3-47d7-bb2f-7e31c7b3755e/coppermine-photo-gallery-versions-1-6-09-1-6-27-contain-an-unauthenticated-path

> Coppermine Photo Gallery versions 1.6.09–1.6.27 contain an unauthenticated path traversal vulnerability allowing remote attackers to read arbitrary files; fixed in 1.6.28.

CERT Polska disclosed CVE-2026-3013, a path traversal vulnerability affecting Coppermine Photo Gallery versions 1.6.09 through 1.6.27. An unauthenticated remote attacker can exploit a vulnerable endpoint to construct payloads that read arbitrary files accessible to the web server process. The vulnerability requires no authentication, making it trivially exploitable by remote adversaries.

The issue has been remediated in version 1.6.28. Organizations running Coppermine Photo Gallery should upgrade immediately to the patched version. The vulnerability was responsibly disclosed by Jan Paweł Klim and coordinated through CERT Polska's vulnerability disclosure process.

Path traversal vulnerabilities in web applications commonly serve as initial access vectors or post-compromise enumeration mechanisms, allowing attackers to retrieve configuration files, application source code, or sensitive user data. Given the unauthenticated nature of this flaw, internet-facing Coppermine installations are at immediate risk of exploitation.

## Mentioned in this report

- Vulnerabilities: CVE-2026-3013

## Detection guidance (public sample)

### Potential Path Traversal Attempt Against Coppermine Photo Gallery

ATT&CK: T1190

Detects HTTP requests containing directory traversal sequences targeting Coppermine Photo Gallery PHP endpoints, consistent with CVE-2026-3013 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Potential Path Traversal Attempt Against Coppermine Photo Gallery
id: 53f6c33f-6894-5d17-8fa7-0b935746268d
status: experimental
description: Detects web requests with directory traversal sequences (encoded or raw)
  targeting Coppermine Photo Gallery PHP scripts, indicative of exploitation attempts
  for CVE-2026-3013.
references:
- CVE-2026-3013
logsource:
  category: webserver
detection:
  selection_app:
    cs-uri-stem|contains:
    - .php
  selection_traversal:
    cs-uri-query|contains:
    - ../
    - ..\\
    - '%2e%2e%2f'
    - '%2e%2e/'
    - ..%2f
    - ..%252f
  filter:
    cs-uri-query|contains:
    - lang=
    - theme=
  condition: selection_app and selection_traversal and not filter
falsepositives:
- Legitimate localization or theme parameters that happen to include relative path
  segments
- Vulnerability scanners or pentest tools probing for traversal
level: high
tags:
- attack.t1190
- attack.initial_access
- cve.2026-3013
author: Vorant
```

### Web Server Process Reading Sensitive OS Files Outside Webroot

ATT&CK: T1190

Detects the web server process (e.g. Apache/PHP-FPM/IIS worker) accessing well-known sensitive system files typically retrieved via path traversal exploitation such as CVE-2026-3013. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server Process Reading Sensitive OS Files Outside Webroot
id: 8e317f30-b987-595e-b00f-b34708bea165
status: experimental
description: Detects file reads of common sensitive system files (passwd, shadow,
  boot.ini, win.ini, config files) by web server or PHP interpreter processes, suggesting
  successful path traversal file disclosure following exploitation of vulnerabilities
  like CVE-2026-3013 in Coppermine Photo Gallery.
references:
- CVE-2026-3013
logsource:
  category: file_event
  product: linux
detection:
  selection_process:
    Image|contains:
    - /apache2/
    - /httpd
    - php-fpm
    - nginx
  selection_target:
    TargetFilename|endswith:
    - /etc/passwd
    - /etc/shadow
    - /etc/hosts
    - win.ini
    - boot.ini
  condition: selection_process and selection_target
falsepositives:
- Legitimate administrative scripts or health-check tools reading system files for
  monitoring purposes
- Backup or configuration-management agents running under the web server account
level: high
tags:
- attack.t1190
- attack.t1083
- cve.2026-3013
author: Vorant
```

### Discovery Commands Spawned by Web Server Process Following Possible Exploitation

ATT&CK: T1083

Detects file and directory discovery commands (ls, find, dir, cat) executed as child processes of a web server, which may indicate post-exploitation enumeration after a path traversal/file disclosure vulnerability such as CVE-2026-3013 was leveraged to gain code execution or shell access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Discovery Commands Spawned by Web Server Process Following Possible Exploitation
id: acf25651-43fc-59f0-a9a4-7bbd2dfb92f0
status: experimental
description: Detects common file/directory discovery commands executed with a web
  server process (apache, nginx, php-fpm, httpd, w3wp) as parent, suggesting post-exploitation
  enumeration following exploitation of an unauthenticated web application vulnerability
  such as CVE-2026-3013.
references:
- CVE-2026-3013
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - /apache2/
    - /httpd
    - php-fpm
    - nginx
  selection_cmd:
    Image|endswith:
    - /ls
    - /find
    - /cat
    - /whoami
    - /id
  condition: selection_parent and selection_cmd
falsepositives:
- Legitimate cron jobs or health-check scripts executed under the web server user
  context
- Administrative maintenance tasks that shell out from web application code
level: medium
tags:
- attack.t1083
- attack.t1190
- cve.2026-3013
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/03/CVE-2026-3013

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b2869d0b-24d3-47d7-bb2f-7e31c7b3755e/coppermine-photo-gallery-versions-1-6-09-1-6-27-contain-an-unauthenticated-path.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup