This vulnerability in osuuu LightPicture (up to version 1.2.2) arises from hard-coded credentials linked to the handling of the /public/install/lp.sql file within the API Upload Endpoint. The issue allows remote attackers to potentially leverage these credentials due to improper processing of an argument key. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. The vendor has not issued any patch or official remediation, and the vulnerability remains unmitigated as of the publication date.

The presence of hard-coded credentials can allow remote attackers to gain unauthorized access or perform actions with elevated privileges on affected versions of osuuu LightPicture. This can compromise the confidentiality, integrity, and availability of the system to a limited extent. Since the vulnerability requires no privileges or user interaction and can be exploited remotely, it poses a tangible risk. However, the impact is rated medium due to the limited scope of the credential exposure and the lack of confirmed active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider mitigating exposure by restricting access to the vulnerable API Upload Endpoint, removing or securing the /public/install/lp.sql file if possible, and monitoring for unusual activity related to this component. Applying compensating controls such as network-level restrictions or application-layer protections may reduce risk until an official patch is released.