Coppermine Gallery 1.6.25 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the plugin manager. Attackers can upload a zipped PHP file with system commands to the plugin directory and execute arbitrary code by accessing the uploaded plugin script.
References
| Link | Resource |
|---|---|
| https://web.archive.org/web/20240101151648/https://coppermine-gallery.net/ | Product |
| https://www.exploit-db.com/exploits/51738 | Exploit Third Party Advisory |
| https://www.vulncheck.com/advisories/coppermine-gallery-remote-code-execution-via-plugin-upload | Third Party Advisory |
| https://www.exploit-db.com/exploits/51738 | Exploit Third Party Advisory |
Configurations
History
18 Dec 2025, 22:35
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Coppermine-gallery
Coppermine-gallery coppermine Photo Gallery |
|
| CPE | cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.6.25:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| References | () https://web.archive.org/web/20240101151648/https://coppermine-gallery.net/ - Product | |
| References | () https://www.exploit-db.com/exploits/51738 - Exploit, Third Party Advisory | |
| References | () https://www.vulncheck.com/advisories/coppermine-gallery-remote-code-execution-via-plugin-upload - Third Party Advisory |
15 Dec 2025, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.exploit-db.com/exploits/51738 - |
15 Dec 2025, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-15 21:15
Updated : 2025-12-18 22:35
NVD link : CVE-2023-53868
Mitre link : CVE-2023-53868
CVE.ORG link : CVE-2023-53868
JSON object : View
Products Affected
coppermine-gallery
- coppermine_photo_gallery
CWE
CWE-434
Unrestricted Upload of File with Dangerous Type