EIP-2026-106160

PRE-CVE

Coppermine Photo Gallery 1.2.2b (Nuke Addon) - Remote File Inclusion

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-106160. PoCs published by 3l3ctric-Cracker.

AI-analyzed exploit summary This exploit demonstrates a Remote File Include (RFI) vulnerability in Coppermine Photo Gallery v1.2.2b for PHPNUKE. The vulnerability arises from unsanitized user input in the THEME_DIR parameter, allowing remote code execution by including malicious files.

Description

Coppermine Photo Gallery 1.2.2b (Nuke Addon) - Remote File Inclusion

Exploits (1)

exploitdb WORKING POC VERIFIED

by 3l3ctric-Cracker · textwebappsphp

https://www.exploit-db.com/exploits/2375

View Code ZIP pw:eip

This exploit demonstrates a Remote File Include (RFI) vulnerability in Coppermine Photo Gallery v1.2.2b for PHPNUKE. The vulnerability arises from unsanitized user input in the THEME_DIR parameter, allowing remote code execution by including malicious files.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: Coppermine Photo Gallery v1.2.2b for PHPNUKE

No auth needed

Prerequisites: Target must have allow_url_include enabled in PHP configuration · Attacker must be able to host a malicious file on a remote server

MITRE ATT&CK

T1189 - Drive-by Compromise T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026