CVE-2019-25709CWE-552

CF Image Hosting Script 1.6.5 Unauthorized Database Access

Critical · published April 12, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
48.3
In the wild
Unconfirmed
What it is

CF Image Hosting Script 1.6.5 allows unauthenticated attackers to download and decode the application database by accessing the imgdb.db file in the upload/data directory. Attackers can extract delete IDs stored in plaintext from the deserialized database and use them to delete all pictures via the d parameter.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00607 · 48.3th percentile
Weakness
CWE-552 · Files or Directories Accessible to External Parties
Published
2026-04-12T12:28Z
EPSS history
Timeline
  • 12 APR 12:28Z
    CF Image Hosting Script 1.6.5 Unauthorized Database Access
    cvelistv5