Description
osuuu LightPicture 1.2.2 存在未授权文件上传漏洞。攻击者可以利用该漏洞上传任意PHP文件至服务器，从而执行任意PHP代码，获取服务器权限。
LightPicture /api/upload 文件上传漏洞（CVE-2025-1835）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-1835
https://github.com/advisories/GHSA-cqg6-gpxx-hq82
https://www.redpacketsecurity.com/cve_alert_cve-2025-1835/
https://vuldb.com/?id.298102
https://intel.enki-guard.com/?mode=vulnerabilities&q=CVE-2025-1835
https://security.glexia.com/cves/CVE-2025-1835
https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2025-1835
https://stack.watch/product/osuuu/
https://cve.imfht.com/detail/CVE-2025-1835