EIP-2026-106166

This exploit leverages a BBCode IMG tag injection vulnerability in Coppermine Photo Gallery to escalate privileges. The attacker crafts a malicious IMG tag containing a URL that, when viewed by an admin, changes the attacker's user group to admin.