CVE-2004-2124: Gallery Project Gallery

Medium severity, CVSS 5.0. EPSS: 7.4% chance of exploitation in the next 30 days.

The register_globals simulation capability in Gallery 1.3.1 through 1.4.1 allows remote attackers to modify the HTTP_POST_VARS variable and conduct a PHP remote file inclusion attack via the GALLERY_BASEDIR parameter, a different vulnerability than CVE-2002-1412.

Affected products

• Gallery Project Gallery: version 1.3.1 only; version 1.3.2 only; version 1.3.3 only; version 1.4 only; version 1.4.1 only

Published 2004-12-31. Last modified 2026-06-16.