Description
Multiple unspecified vulnerabilities in Gallery before 2.2.3 allow attackers to (1) rename items, (2) read and modify item properties, or (3) lock and replace items via unknown vectors in (a) the WebDAV module; and (4) edit unspecified data files using "linked items" in WebDAV and (b) Reupload modules.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | gallery2 | 2.1.2-2.0.etch.1 | DSA-1404-1 |
Advisories 1
- DSA-1404-1 gallery2 - privilege escalation Debian Security (DSA / DLA) · Mar 9, 2026
References
- GLSA-200711-03 vendor-advisory
- 26719 third-party-advisory
- 41657 vdb-entry
- ADV-2007-3072 vdb-entry
- DSA-1404 vendor-advisory
- 41658 vdb-entry
- 27594 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=267421
- FEDORA-2007-2020 vendor-advisory
- 25580 vdb-entry
- http://gallery.menalto.com/gallery_2.2.3_released
- 26716 third-party-advisory
- 27502 third-party-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=191587