CF Image Hosting Script 1.6.5 contains a flaw that allows any user on the Internet to download the application's SQLite database file (imgdb.db) from the upload/data directory without authentication. The database can then be decoded to reveal delete identifiers stored in plain text. With these identifiers, an attacker can invoke the delete handler via the d parameter and remove every picture stored by the application, effectively causing a denial of service and loss of user content.

The vulnerability affects the CF Image Hosting Script developed by Davidtavarez, version 1.6.5. No further version details are supplied by the CNA, but the CPE indicates only this specific release is impacted.

The flaw scores a 9.3 on CVSS, indicating high severity. EPSS data is not available and the issue is not listed in CISA's KEV catalog. The likely attack vector is remote unauthenticated HTTP access to a publicly readable file, so any web user can exploit it without credentials or special conditions.