PT-2026-122136
CVE-2026-102786
·
Published
2026-10-23
·
Updated
2026-10-23
Description by
CVSS 4.0
8.6
HighMetricsAV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Phoca Gallery versions 4.5.0 through 6.1.5
Description
An authenticated stored cross-site scripting issue exists in the front-end photo info view. The application prints an image's EXIF metadata (exchangeable image file format) into the page without proper escaping. This allows a user with image upload privileges to embed a crafted image that breaks out of an HTML attribute to execute arbitrary scripts when another user, including an administrator, views the photo's info page.
Recommendations
Update Phoca Gallery to version 6.1.6.
As a temporary mitigation, remove the gallery from the installation.
Found an issue in the description? Have something to add? Feel free to write us 👾