Vulnerabilities

TI-2026-28813 CVE-2026-39957

Incorrect authorization in LycheeOrg Lychee

MEDIUM 45

Lychee is a free, open-source photo-management tool.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00211 Published 2026-04-09 Fixed in 7.5.4 CWE-863

TI-2026-26117 CVE-2026-33738

Lychee Vulnerable to Stored XSS via Photo Description in RSS/Atom/JSON Feed (No Sanitization on Public Endpoint)

MEDIUM 55

Lychee is a free, open-source photo-management tool.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00222 Published 2026-03-26 Fixed in 7.5.3 CWE-79

TI-2026-26025 CVE-2026-33644

Server-side request forgery in LycheeOrg Lychee

LOW 12

Lychee is a free, open-source photo-management tool.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00239 Published 2026-03-26 Fixed in 7.5.2 CWE-918

TI-2026-25930 CVE-2026-33537

Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked

MEDIUM 57

Lychee is a free, open-source photo-management tool.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0027 Published 2026-03-26 Fixed in 7.5.1 CWE-918

TI-2026-18302 CVE-2026-22784

Lychee cross-album password propagation on Album unlocking

LOW 12

Lychee is a free, open-source photo-management tool.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00271 Published 2026-01-12 Fixed in 7.1.0 CWE-863

TI-2024-16953 CVE-2024-25808 · GHSA-386g-6xm2-mvq6

Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote…

HIGH 71

Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create new album function.

CVSS 3.1HIGH 8.3 Network No auth User interaction EPSS 0.00377 Published 2024-03-22 No fix listed CWE-352

TI-2024-16952 CVE-2024-25807 · GHSA-wpwv-j45h-pwcg

Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to…

MEDIUM 60

Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title parameter when creating an album.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0046 Published 2024-03-22 No fix listed CWE-79

TI-2023-28525 CVE-2023-52082

Lychee is vulnerable to an SQL Injection in explain DB queries.

MEDIUM 43

Lychee is a free photo-management tool.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00472 Published 2023-12-28 Fixed in 5.0.2 CWE-89

TI-2021-19511 CVE-2021-43675 · GHSA-qwgg-mr66-9fcp

Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in…

LOW 29

Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in php/Access/Guest.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00879 Published 2021-12-15 No fix listed CWE-79

Vulnerabilities

Filters