Medium severity · published Mar 22, 2024
CVE-2024-25807
Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title parameter when creating…
6.1
CVSS
0.5%
EPSS
No
On KEV
Description
Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title parameter when creating an album.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LY
Lychee · Lycheeorg
3.1.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-25807
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-25807
Exploit
https://github.com/Hebing123/cve/issues/17
More from Lychee
9.8
CVE-2023-52082
Lychee is a free photo-management tool
8.9
CVE-2026-62679
Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read
8.3
CVE-2026-77466
Lychee: Webshop payment bypass via unrestricted "Dummy" gateway selection
8.3
CVE-2026-77470
Lychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST request
8.3
CVE-2024-25808
Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create new album function