CVE-2026-6574

CVE-2026-6574 is a vulnerability affecting osuuu LightPicture versions up to 1.2.2 that allows attackers to access hard-coded credentials through manipulation of the key parameter in the API Upload Endpoint at /public/install/lp.sql. The vulnerability requires no authentication or user interaction to exploit and can be conducted entirely from a remote location. The vulnerability carries a HIGH severity rating with a CVSS score of 7.3, reflecting its network-based attack vector, low complexity, and ability to impact confidentiality, integrity, and availability. The attack requires no privileges or user interaction, making it readily exploitable by threat actors with minimal resources or technical sophistication. Exploitation of this vulnerability is considered active within the broader threat landscape, as evidenced by its placement on the Hot List and public disclosure of the exploit. While the EPSS score of 0.000380 suggests relatively low predictive probability of exploitation in the next 30 days, the public availability of exploit code combined with vendor non-responsiveness significantly increases practical exploitation risk. Organizations running affected LightPicture versions should prioritize patching or isolation measures immediately.