themes/sample/theme.php in Coppermine Photo Gallery (CPG) 1.4.18 and earlier allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message.

More... (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3481)