Lychee — Vulnerabilities & Security Advisories 8

All 8 CVE vulnerabilities found in Lychee, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-39957	Lychee has Broken Access Control in SharingController::listAll() leaks private album sharing metadata to unauthorized users CWE-863	6.5^AI	Medium^AI	2026-04-09
CVE-2026-33738	Lychee Vulnerable to Stored XSS via Photo Description in RSS/Atom/JSON Feed (No Sanitization on Public Endpoint) CWE-79	6.1	-	2026-03-26
CVE-2026-33644	Lychee has SSRF bypass via DNS rebinding — PhotoUrlRule only validates IP addresses, not hostnames resolving to internal IPs CWE-918	7.5	-	2026-03-26
CVE-2026-33537	Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked CWE-918	7.1^AI	High^AI	2026-03-26
CVE-2026-22784	Lychee cross-album password propagation on Album unlocking CWE-863	8.1^AI	High^AI	2026-01-12
CVE-2025-53018	Lychee has Server-Side Request Forgery (SSRF) in Photo::fromUrl API via unvalidated remote image URLs CWE-918	3.0	Low	2025-06-27
CVE-2025-50202	Lychee Path Traversal Vulnerability CWE-22	7.5	High	2025-06-18
CVE-2023-52082	Lychee is vulnerable to an SQL Injection in explain DB queries. CWE-89	8.8	High	2023-12-28

All 8 known CVE vulnerabilities affecting Lychee with full Chinese analysis, references, and POCs where available.