LycheeOrg — Vulnerabilities & Security Advisories 18

LycheeOrg develops a self-hosted photo management application for organizing and sharing images. Historically, the project has been vulnerable to multiple remote code execution flaws, cross-site scripting vulnerabilities, and privilege escalation issues, with eight CVEs documented to date. Security researchers have identified common weaknesses in file upload mechanisms, insufficient input validation, and improper access controls. While no major public security incidents have been widely reported, the consistent pattern of vulnerabilities suggests potential risks for organizations deploying the software without hardening. The project's open-source nature allows for community scrutiny but also means vulnerabilities may be exploited before patches are applied.