LycheeOrg vulnerabilities
We track 9 vulnerabilities in LycheeOrg products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on October 15, 2026.
Latest LycheeOrg vulnerabilities
- 8.3 High severity
Lychee is a free, open-source photo-management tool.
Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array and CheckoutService::preparePurchaseParameters() merges it after server-comp
- 7.1 High severity
Lychee: Uncontrolled Resource Consumption
Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee enables ImageMagick PDF support with Ghostscript but does not apply an effective pre-render limit to PDF page dimensions in ImagickHandler::loadPdf(). An authenticated user who can upl
- 8.3 High severity
Lychee is a free, open-source photo-management tool.
Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::get_supported_providers(), but CreateSessionRequest validates only that the submit
- 8.9 High severity
Lychee: Improper Limitation of a Pathname to a Restricted Directory
Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/{path}, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segmen
- 8.2 High severity
Lychee: Improper Authorization
Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload() and PhotoPolicy::canDownload() without first enforcing AlbumPolicy::canAccess(). For a public, password-
- 7.5 High severity
Lychee: Improper Restriction of Excessive Authentication Attempts
Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA, or lockout. UnlockAlbumRequest::authorize() permits any caller to submit attempts, and app/Actions/Album/Unlock.
- 7.5 High severity
Lychee: Improper Limitation of a Pathname to a Restricted Directory
Lychee is a free photo-management tool. In versions starting from 6.6.6 to before 6.6.10, an attacker can leak local files including environment variables, nginx logs, other user's uploaded images, and configuration secrets due to a path traversal exploit in S
- 8.3 High severity
lychee: Cross-Site Request Forgery
Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create new album function.
- 9.8 Critical severity
Lychee: Improper Neutralization of Special Elements used in an SQL Command
Lychee is a free photo-management tool. Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the `.env` settings set to DB_LOG_SQL=true and DB_LOG_SQL_EXPLAIN=true. The d