PT-2025-51286 · Unknown · Coppermine-Gallery

Mirabbas Ağalarov · Published 2025-12-15 · Updated 2025-12-21 · CVE-2023-53868

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Coppermine Gallery version 1.6.25

Description Coppermine Gallery version 1.6.25 has a remote code execution issue. Authenticated attackers can upload malicious PHP files through the plugin manager. Attackers can upload a zipped PHP file containing system commands to the plugin directory and then execute arbitrary code by accessing the uploaded plugin script. The vulnerability affects systems where an authenticated user has the ability to manage plugins.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the plugin manager functionality to prevent unauthorized file uploads.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-53868

Affected Products

Coppermine-Gallery

References · 8

• 🔥 https://exploit-db.com/exploits/51738 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-53868 · Security Note
• https://osv.dev/vulnerability/CVE-2023-53868 · Vendor Advisory
• https://twitter.com/CVEnew/status/2002857380695146962 · Twitter Post
• https://vulncheck.com/advisories/coppermine-gallery-remote-code-execution-via-plugin-upload · Note
• https://twitter.com/VulmonFeeds/status/2000761145028747645 · Twitter Post
• https://t.me/cveNotify/146261 · Telegram Post
• https://web.archive.org/web/20240101151648/https://coppermine-gallery.net · Note