LY
Product
Lychee
21
CVEs
0
On KEV
9.8
Max CVSS
10
New 30D
Severity mix
Critical 1High 8Medium 9Low 3
Watch
Add Lychee to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-52082 | 9.8 | Dec 28 | Lychee is a free photo-management tool Affected: 4.9.3 before 5.0.2 |
| CVE-2026-62679 | 8.9 | Oct 15 | Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read Affected: < 7.6.4 |
| CVE-2026-77466 | 8.3 | Oct 15 | Lychee: Webshop payment bypass via unrestricted "Dummy" gateway selection Affected: < 7.7.0 |
| CVE-2026-77470 | 8.3 | Oct 15 | Lychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST request Affected: < 7.7.1 |
| CVE-2024-25808 | 8.3 | Mar 22 | Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create new album function Affected: 3.1.6 |
| CVE-2026-61838 | 8.2 | Oct 15 | Lychee: Album password bypass in ZIP downloads Affected: < 7.6.3 |
| CVE-2026-61611 | 7.5 | Oct 15 | Lychee: Missing rate limiting on album password unlock endpoint allows brute-force attacks Affected: < 7.6.1 |
| CVE-2025-50202 | 7.5 | Jun 18 | Lychee Path Traversal Vulnerability Affected: >= 6.6.6, < 6.6.10 |
| CVE-2026-77467 | 7.1 | Oct 15 | Lychee: A single 383-byte PDF causes ~184 seconds of CPU consumption in the real processing path Affected: < 7.7.0 |
| CVE-2026-77468 | 6.9 | Oct 15 | Lychee: Missing Authentication for Critical Function and Allocation of Resources Without Limits or Throttling on /docs/api Affected: < 7.7.0 |
| CVE-2024-25807 | 6.1 | Mar 22 | Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title parameter when creating… Affected: 3.1.6 |
| CVE-2021-43675 | 6.1 | Dec 15 | Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in php/Access/Guest.php Affected: 3.2.16 |
| CVE-2026-57568 | 5.7 | Oct 15 | Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View) Affected: < 7.6.0 |
| CVE-2026-33738 | 5.4 | Mar 26 | Lychee Vulnerable to Stored XSS via Photo Description in RSS/Atom/JSON Feed (No Sanitization on Public Endpoint) Affected: < 7.5.3 |
| CVE-2026-33537 | 5.0 | Mar 26 | Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked Affected: < 7.5.1 |
| CVE-2026-39957 | 4.3 | Apr 9 | Lychee has Broken Access Control in SharingController::listAll() leaks private album sharing metadata to unauthorized users Affected: < 7.5.4 |
| CVE-2026-33644 | 4.3 | Mar 26 | Lychee has SSRF bypass via DNS rebinding — PhotoUrlRule only validates IP addresses, not hostnames resolving to internal IPs Affected: < 7.5.2 |
| CVE-2026-22784 | 4.3 | Jan 12 | Lychee cross-album password propagation on Album unlocking Affected: < 7.1.0 |
| CVE-2025-53018 | 3.0 | Jun 27 | Lychee has Server-Side Request Forgery (SSRF) in Photo::fromUrl API via unvalidated remote image URLs Affected: < 6.6.13 |
| CVE-2026-61610 | 2.3 | Oct 15 | Lychee: unauthenticated photo starring reveals existence of private photos when photos_star_visibility=anonymous Affected: < 7.6.1 |
| CVE-2026-57569 | 2.3 | Oct 15 | Lychee: Distinct post-fix SSRF variant in Photo::fromUrl due to missing IP pinning after DNS-based validation Affected: < 7.6.0 |
Showing 21