Vulnerabilities

TI-2026-74845 CVE-2026-77466

Payment bypass in Lychee webshop through unrestricted Dummy gateway

HIGH 69

Lychee is a free, open-source photo-management tool.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00439 Published 2026-10-15 Fixed in 7.7.0 CWE-184

TI-2026-74848 CVE-2026-77470

Lychee webshop checkout lets buyers override payment amount

HIGH 69

Lychee is a free, open-source photo-management tool.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00451 Published 2026-10-15 Fixed in 7.7.1 CWE-20

TI-2026-74847 CVE-2026-77468

Lychee exposes unauthenticated, unthrottled /docs/api endpoint

LOW 37

Lychee is a free, open-source photo-management tool.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00371 Published 2026-10-15 Fixed in 7.7.0 CWE-770

TI-2026-74846 CVE-2026-77467

Uncontrolled resource consumption in Lychee PDF processing

MEDIUM 64

Lychee is a free, open-source photo-management tool.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.0034 Published 2026-10-15 Fixed in 7.7.0 CWE-400

TI-2026-74844 CVE-2026-62679

Path traversal in Lychee lets authenticated users read server files

LOW 38

Lychee is a free, open-source photo-management tool.

CVSS 4.0HIGH 8.9 Network Low privileges No interaction EPSS 0.00353 Published 2026-10-15 Fixed in 7.6.4 CWE-22

TI-2026-74843 CVE-2026-61838

Album password bypass in Lychee ZIP downloads

HIGH 75

Lychee is a free, open-source photo-management tool.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00422 Published 2026-10-15 Fixed in 7.6.3 CWE-285

TI-2026-74841 CVE-2026-61610

Lychee access control flaw exposes and alters private photos

MEDIUM 51

Lychee is a free, open-source photo-management tool.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00306 Published 2026-10-15 Fixed in 7.6.1 CWE-284

TI-2026-74842 CVE-2026-61611

Missing rate limiting in Lychee album unlock allows password guessing

HIGH 72

Lychee is a free, open-source photo-management tool.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00454 Published 2026-10-15 Fixed in 7.6.1 CWE-307

TI-2026-74840 CVE-2026-57569

DNS rebinding bypasses SSRF checks in Lychee photo URL import

MEDIUM 45

Lychee is a free, open-source photo-management tool.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00241 Published 2026-10-15 Fixed in 7.6.0 CWE-367

TI-2026-74839 CVE-2026-57568

Stored XSS in Lychee gallery view through Markdown javascript links

LOW 25

Lychee is a free, open-source photo-management tool.

CVSS 4.0MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00278 Published 2026-10-15 Fixed in 7.6.0 CWE-79

TI-2026-28813 CVE-2026-39957

Incorrect authorization in LycheeOrg Lychee

MEDIUM 45

Lychee is a free, open-source photo-management tool.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00211 Published 2026-04-09 Fixed in 7.5.4 CWE-863

TI-2026-26117 CVE-2026-33738

Lychee Vulnerable to Stored XSS via Photo Description in RSS/Atom/JSON Feed (No Sanitization on Public Endpoint)

MEDIUM 55

Lychee is a free, open-source photo-management tool.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00222 Published 2026-03-26 Fixed in 7.5.3 CWE-79

TI-2026-26025 CVE-2026-33644

Server-side request forgery in LycheeOrg Lychee

LOW 12

Lychee is a free, open-source photo-management tool.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00239 Published 2026-03-26 Fixed in 7.5.2 CWE-918

TI-2026-25930 CVE-2026-33537

Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked

MEDIUM 57

Lychee is a free, open-source photo-management tool.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0027 Published 2026-03-26 Fixed in 7.5.1 CWE-918

TI-2026-18302 CVE-2026-22784

Lychee cross-album password propagation on Album unlocking

LOW 12

Lychee is a free, open-source photo-management tool.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00271 Published 2026-01-12 Fixed in 7.1.0 CWE-863

TI-2025-33020 CVE-2025-53018

Lychee has Server-Side Request Forgery (SSRF) in Photo::fromUrl API via unvalidated remote image URLs

MEDIUM 48

Lychee is a free, open-source photo-management tool.

CVSS 3.1LOW 3.0 Network Low privileges User interaction EPSS 0.00196 Published 2025-06-27 Fixed in 6.6.13 CWE-918

TI-2025-32085 CVE-2025-50202

Lychee Path Traversal Vulnerability

MEDIUM 40

Lychee is a free photo-management tool.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00616 Published 2025-06-18 Fixed in 6.6.10 CWE-22

TI-2024-16953 CVE-2024-25808 · GHSA-386g-6xm2-mvq6

Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote…

HIGH 71

Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create new album function.

CVSS 3.1HIGH 8.3 Network No auth User interaction EPSS 0.00377 Published 2024-03-22 No fix listed CWE-352

TI-2024-16952 CVE-2024-25807 · GHSA-wpwv-j45h-pwcg

Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to…

MEDIUM 60

Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title parameter when creating an album.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0046 Published 2024-03-22 No fix listed CWE-79

TI-2023-28525 CVE-2023-52082

Lychee is vulnerable to an SQL Injection in explain DB queries.

MEDIUM 43

Lychee is a free photo-management tool.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00472 Published 2023-12-28 Fixed in 5.0.2 CWE-89

TI-2021-19511 CVE-2021-43675 · GHSA-qwgg-mr66-9fcp

Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in…

LOW 29

Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in php/Access/Guest.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00879 Published 2021-12-15 No fix listed CWE-79

Vulnerabilities

Filters