Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Lychee — Vulnerabilities & Security Advisories 18

All 18 CVE vulnerabilities found in Lychee, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities affecting the Lychee photo management software, categorized by specific weakness types and relevant security tags. The collection encompasses a comprehensive range of reported issues, including remote code execution, local privilege escalation, and cross-site scripting flaws, spanning the product's entire release history from its initial public launch to the most recent stable version. Visitors can utilize this resource to track official vendor advisories for Lychee, analyze the prevalence and impact of specific weakness classes within image gallery applications, or review the complete vulnerability timeline for this specific product to assess historical security posture. The data presented here is derived from public disclosures, vendor bulletins, and community reports, offering a centralized view of known risks without requiring access to multiple disparate sources. By examining the aggregated entries, security professionals and system administrators can identify patterns in how Lychee has been compromised over time, enabling more informed decisions regarding patch management and defensive configuration. This compilation serves as a factual reference for understanding the security evolution of the software, highlighting critical areas where past implementations have failed and where current versions may still require attention. All information is presented objectively to support vulnerability research and risk assessment activities related to the Lychee ecosystem.

Vendor: LycheeOrg

CVE ID Title CVSS Severity Published
CVE-2026-77466 Lychee: Webshop payment bypass via unrestricted "Dummy" gateway selection CWE-20 8.3 High 2026-10-15
CVE-2026-77470 Lychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST request CWE-20 8.3 High 2026-10-15
CVE-2026-77468 Lychee: Missing Authentication for Critical Function and Allocation of Resources Without Limits or Throttling on /docs/api CWE-770 6.9 Medium 2026-10-15
CVE-2026-77467 Lychee: A single 383-byte PDF causes ~184 seconds of CPU consumption in the real processing path CWE-400 7.1 High 2026-10-15
CVE-2026-62679 Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read CWE-22 8.9 High 2026-10-15
CVE-2026-61838 Lychee: Album password bypass in ZIP downloads CWE-285 8.2 High 2026-10-15
CVE-2026-61610 Lychee: unauthenticated photo starring reveals existence of private photos when photos_star_visibility=anonymous CWE-284 2.3 Low 2026-10-15
CVE-2026-61611 Lychee: Missing rate limiting on album password unlock endpoint allows brute-force attacks CWE-307 7.5 High 2026-10-15
CVE-2026-57569 Lychee: Distinct post-fix SSRF variant in Photo::fromUrl due to missing IP pinning after DNS-based validation CWE-367 2.3 Low 2026-10-15
CVE-2026-57568 Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View) CWE-79 5.7 Medium 2026-10-15
CVE-2026-39957 Lychee has Broken Access Control in SharingController::listAll() leaks private album sharing metadata to unauthorized users CWE-863 6.5AI Medium AI 2026-04-09
CVE-2026-33738 Lychee Vulnerable to Stored XSS via Photo Description in RSS/Atom/JSON Feed (No Sanitization on Public Endpoint) CWE-79 6.1 - 2026-03-26
CVE-2026-33644 Lychee has SSRF bypass via DNS rebinding — PhotoUrlRule only validates IP addresses, not hostnames resolving to internal IPs CWE-918 7.5 - 2026-03-26
CVE-2026-33537 Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked CWE-918 7.1AI High AI 2026-03-26
CVE-2026-22784 Lychee cross-album password propagation on Album unlocking CWE-863 8.1AI High AI 2026-01-12
CVE-2025-53018 Lychee has Server-Side Request Forgery (SSRF) in Photo::fromUrl API via unvalidated remote image URLs CWE-918 3.0 Low 2025-06-27
CVE-2025-50202 Lychee Path Traversal Vulnerability CWE-22 7.5 High 2025-06-18
CVE-2023-52082 Lychee is vulnerable to an SQL Injection in explain DB queries. CWE-89 8.8 High 2023-12-28

All 18 known CVE vulnerabilities affecting Lychee with full Chinese analysis, references, and POCs where available.