high8.8

CVE-2025-56263

by-night sms V1.0 has an Arbitrary File Upload vulnerability.

Impact

by-night sms V1.0 has an Arbitrary File Upload vulnerability. The /api/sms/upload/headImg endpoint allows uploading arbitrary files. Users can upload files of any size and type.

Affected products

Vendor	Product	Affected versions
By-Night	Sms	Version 1.0

Weakness classification

CWE-434

References

NVD record
CVE.org record
https://github.com/by-night/sms/issues/50
https://github.com/echo0d/vulnerability/blob/main/by-night_sms/fileUpload.md