CVE-2026-76010

Name of the Vulnerable Software and Affected Versions NextGEN Gallery versions prior to 4.4.2

Description Remote Code Execution is possible for authenticated attackers with custom-level access and above. The issue occurs via the render image() function due to unrestricted mass assignment of caller-supplied meta data keys onto the image model, combined with missing realpath containment in path construction and a bypassable signature check on the public image delivery route. Access is maintained even after the 'NextGEN Manage gallery' capability is revoked because the can manage gallery() function uses a stored gallery-author equality fallback.

Recommendations Update to version 4.4.2 or later. As a temporary mitigation, restrict access to the render image() function for users with low-level privileges.