Read the docs
TI-2023-28525 Aliases CVE-2023-52082

Lychee is vulnerable to an SQL Injection in explain DB queries.

Priority MEDIUM 43CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

Lychee is a free photo-management tool. Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the `.env` settings set to DB_LOG_SQL=true and DB_LOG_SQL_EXPLAIN=true. The defaults settings of Lychee are safe. The patch is provided on version 5.0.2. To work around this issue, disable SQL EXPLAIN logging.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00472 41st percentileScored 2026-11-07
Fix Fixed Lychee (LycheeOrg): 5.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LycheeOrgLycheebefore 5.0.25.0.2Patch availableCNA
  • Lychee VendorLycheeOrg Affected before 5.0.2 Fixed in 5.0.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:lycheeorg:lychee:*:*:*:*:*:*:*:*4.9.3 to before 5.0.2VulnerableLycheeOrg
  • cpe:2.3:a:lycheeorg:lychee:*:*:*:*:*:*:*:* Versions 4.9.3 to before 5.0.2 Vulnerable ·LycheeOrg

Remediation

  • Fix · CNA Lychee (LycheeOrg) Fixed in 5.0.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-52082

References

Patch 1

Advisory 1

  • TI-2024-16953 Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote… CVSS 3.1HIGH 8.3
  • TI-2024-16952 Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to… CVSS 3.1MEDIUM 6.1
  • TI-2026-25930 Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked CVSS 4.0MEDIUM 5.3
  • TI-2026-26117 Lychee Vulnerable to Stored XSS via Photo Description in RSS/Atom/JSON Feed (No Sanitization on Public Endpoint) CVSS 4.0MEDIUM 4.8
  • TI-2026-28813 Incorrect authorization in LycheeOrg Lychee CVSS 4.0LOW 2.3
  • TI-2021-19511 Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in… CVSS 3.1MEDIUM 6.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences