High · 8.8 CVE-2025-56263 EUVD-2025-29649GHSA-fpcm-8wrp-qj95

by-night sms V1.0 has an Arbitrary File Upload vulnerability. The /api/sms/upload/headImg endpoint allows uploading arbitrary files. Users …

Published Sep 16, 2025 · Updated Sep 17, 2025 · Assigned by mitre

Description

by-night sms V1.0 has an Arbitrary File Upload vulnerability. The /api/sms/upload/headImg endpoint allows uploading arbitrary files. Users can upload files of any size and type.

References

https://github.com/by-night/sms/issues/50
https://github.com/echo0d/vulnerability/blob/main/by-night_sms/fileUpload.md