CVE-2026-76012

Name of the Vulnerable Software and Affected Versions NextGEN Gallery versions prior to 4.4.2

Description Remote Code Execution is possible via the legacy render() function. The issue stems from broken authorization on the 'Lightroom gallery edit' endpoint, combined with mass assignment of the gallery path and unrestricted file upload into a registered template directory. The system uses a substring match for extension checks, which incorrectly accepts sanitized .php filenames as valid templates. Authenticated attackers with custom-level access or higher can execute code on the server, provided they are the stored author of at least one existing gallery, as this ownership is the only authorization check for the mass-assignment and upload process.

Recommendations Update to version 4.4.2 or later.