CVE-2019-25709: CF Image Hosting Script 1.6.5 Database Exposure and Unauthorized Deletion

Overview

CVE-2019-25709 is a critical severity vulnerability (CVSS 9.8) affecting CF Image Hosting Script version 1.6.5. The flaw enables unauthenticated remote attackers to directly access and download the application's SQLite database file, extract sensitive delete IDs stored in plaintext, and leverage those IDs to permanently delete all images hosted on the service.

This vulnerability was published to the National Vulnerability Database (NVD) on April 12, 2026, and affects any publicly accessible deployment of CF Image Hosting Script 1.6.5 that has not applied mitigations.

Technical Details

Vulnerability Type

• CWE Classification: Improper Access Control / Information Disclosure
• CVSS Score: 9.8 (Critical)
• Attack Vector: Network (remote, unauthenticated)
• Authentication Required: None

How the Attack Works

The application stores its database file at a predictable and publicly accessible path:

/upload/data/imgdb.db

An attacker can issue a simple HTTP GET request to retrieve the entire SQLite database without any credentials or session tokens. Once downloaded, the database can be deserialized using standard SQLite tooling to expose all stored records.

Within this database, image delete IDs are stored in plaintext. These IDs are the only authorization mechanism protecting image deletion. An attacker who obtains them can submit requests to delete any or all images hosted on the platform — effectively wiping the entire service.

Attack chain summary:

1. Attacker sends GET /upload/data/imgdb.db to the target server
2. Server returns the full SQLite database without authentication
3. Attacker deserializes database, extracts plaintext delete IDs
4. Attacker submits deletion requests using extracted IDs
5. All hosted images are deleted — no credentials required

Impact

Any operator running CF Image Hosting Script 1.6.5 with the default configuration is at risk of:

• Complete data theft: All image metadata, URLs, and delete credentials exposed
• Irreversible content deletion: Hosted images can be wiped by any remote actor
• Reputational damage: Users relying on the platform for image hosting lose all content

Affected Versions

Remediation

Immediate Mitigations

1. Restrict web server access to the database file. Add a server-level rule to block HTTP access to *.db files in the upload/data/ directory.

   Apache (.htaccess):

   <FilesMatch "\.db$">
       Order Allow,Deny
       Deny from all
   </FilesMatch>

   Copy

   Nginx:

   location ~* \.db$ {
       deny all;
       return 403;
   }

   Copy

2. Move the database outside the web root. Store imgdb.db in a directory not served by the web server, then update application configuration to reference the new path.

3. Rotate delete IDs. Treat all existing delete IDs as compromised. Regenerate credentials if the application supports it.

4. Audit server access logs. Review HTTP access logs for GET /upload/data/imgdb.db requests that may indicate prior exploitation.

5. Consider migrating to a maintained alternative. CF Image Hosting Script 1.6.5 appears to be an unmaintained project. Evaluate supported alternatives for production image hosting.

References

• NVD Entry — CVE-2019-25709
• CVSS v3.1 Score: 9.8 Critical
• Published: April 12, 2026

Disclosure Timeline

This advisory is published for informational and defensive purposes. If you operate CF Image Hosting Script, apply the mitigations above immediately.