Description
Cross-site scripting (XSS) vulnerability in Gallery 1.5.1-RC2 and earlier allows remote attackers to inject arbitrary web script or HTML via EXIF data, such as the Camera Model Tag.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | gallery | 1.5-1sarge2 | DSA-1148-1 |
Advisories 1
- DSA-1148-1 gallery - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 21502 third-party-advisory
- 16594 third-party-advisory
- DSA-1148 vendor-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=325285
- 1014800 vdb-entry
- 14668 vdb-entry
- http://sourceforge.net/project/shownotes.php?release_id=352576
- photopost-exif-xss(22020) vdb-entry
- 20050826 Multiple PHP Images Galleries EXIF Metadata XSS Vulnerabilities mailing-list