The flaw originates from the LightPicture API Upload Endpoint where manipulation of an argument key causes the application to load hard‑coded credentials from the /public/install/lp.sql file. This enables an attacker to obtain valid authentication tokens or administrator credentials from a remote connection, creating a path to compromise the system. The weakness is categorized as CWE‑259 (Use of Hard‑coded Password) and CWE‑798 (Use of Hard‑coded Credentials).

The vulnerability affects osuuu LightPicture versions up to and including 1.2.2. The impacted component is the upload functionality accessible externally via the API. No other vendor or product variants are listed as vulnerable.

The CVSS score of 6.9 indicates a moderate severity. EPSS data is unavailable, but the vulnerability has been publicly disclosed and can be exploited remotely without special privileges, implying a realistic chance of exploitation. The vulnerability is not present in the CISA KEV catalog, yet the lack of vendor response increases potential risk. Attackers can craft requests to the upload endpoint to trigger the execution of the hard‑coded credential logic, gaining unauthorized access to the application.