CVE-2008-1840: Coppermine Photo Gallery

Medium severity, CVSS 6.5. EPSS: 1.8% chance of exploitation in the next 30 days.

SQL injection vulnerability in upload.php in Coppermine Photo Gallery (CPG) 1.4.16 and earlier allows remote authenticated users or user-assisted remote HTTP servers to execute arbitrary SQL commands via the Content-Type HTTP response header provided by the HTTP server that is used for an upload.

Affected products

• Coppermine Coppermine Photo Gallery: up to and including 1.4.16; version 1.4 only; version 1.4.1 only; version 1.4.2 only; version 1.4.3 only; version 1.4.4 only; …

Published 2008-04-16. Last modified 2026-06-16.