What’s Vulnerable › Products

LycheeOrg Lychee vulnerabilities

21 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 17 published in the last 12 months.

Check whether your LycheeOrg Lychee version is affected

Latest LycheeOrg Lychee vulnerabilities

• CVE-2026-77470 — Lychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST request (CVSS 8.3)
• CVE-2026-77468 — Lychee: Missing Authentication for Critical Function and Allocation of Resources Without Limits or Throttling on /docs/api (CVSS 6.9)
• CVE-2026-77467 — Lychee: A single 383-byte PDF causes ~184 seconds of CPU consumption in the real processing path (CVSS 7.1)
• CVE-2026-77466 — Lychee: Webshop payment bypass via unrestricted "Dummy" gateway selection (CVSS 8.3)
• CVE-2026-62679 — Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read (CVSS 8.9)
• CVE-2026-61838 — Lychee: Album password bypass in ZIP downloads (CVSS 8.2)
• CVE-2026-61611 — Lychee: Missing rate limiting on album password unlock endpoint allows brute-force attacks (CVSS 7.5)
• CVE-2026-61610 — Lychee: unauthenticated photo starring reveals existence of private photos when photos_star_visibility=anonymous (CVSS 2.3)
• CVE-2026-57569 — Lychee: Distinct post-fix SSRF variant in Photo::fromUrl due to missing IP pinning after DNS-based validation (CVSS 2.3)
• CVE-2026-57568 — Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View) (CVSS 5.7)
• CVE-2026-39957 — Lychee has Broken Access Control in SharingController::listAll() leaks private album sharing metadata to unauthorized users (CVSS 4.3)
• CVE-2026-33738 — Lychee Vulnerable to Stored XSS via Photo Description in RSS/Atom/JSON Feed (No Sanitization on Public Endpoint) (CVSS 5.4)
• CVE-2026-33644 — Lychee has SSRF bypass via DNS rebinding — PhotoUrlRule only validates IP addresses, not hostnames resolving to internal IPs (CVSS 4.3)
• CVE-2026-33537 — Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked (CVSS 5.0)
• CVE-2026-22784 — Lychee cross-album password propagation on Album unlocking (CVSS 4.3)
• CVE-2025-53018 — Lychee has Server-Side Request Forgery (SSRF) in Photo::fromUrl API via unvalidated remote image URLs (CVSS 3.0)
• CVE-2025-50202 — Lychee Path Traversal Vulnerability (CVSS 7.5)
• CVE-2024-25808 — (CVSS 8.3)
• CVE-2024-25807 — (CVSS 6.1)
• CVE-2023-52082 — Lychee is vulnerable to an SQL Injection in explain DB queries. (CVSS 9.8)
• CVE-2021-43675 — (CVSS 6.1)