CVE-2004-1466: The set_time_limit function in Gallery before 1.4.4_p2 deletes non-image files in a temporary directory eve...

Security readout for executives and security teams

This old Gallery flaw can let a remote attacker upload a script and run it before Gallery deletes it, but only when the temporary upload directory is reachable from the web. The main business risk is server compromise on legacy Gallery deployments. There is no cited evidence of current active exploitation. Exposure is likely limited to legacy Gallery installations before 1.4.4_p2, especially internet-facing sites where the temporary upload directory is inside the web root. The provided affected-product metadata is incomplete, so asset confirmation is required. Prioritize remediation if any internet-facing Gallery instance remains in use. The flaw is old, but the impact can be server-side code execution under a common risky configuration. If Gallery is not deployed, no action beyond asset confirmation is needed. Mitigation focus: Upgrade Gallery to 1.4.4_p2 or later if still deployed.; Move temporary upload directories outside the web root.; Restrict direct web access to upload and temporary directories..

Prepared

Jun 30, 2026, 00:54 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.