LycheeOrg Lychee

• CVE-2026-77466 High 8.3 Lychee: Webshop payment bypass via unrestricted "Dummy" gateway selection 0.4%
• CVE-2026-77470 High 8.3 Lychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST request 0.5%
• CVE-2026-77468 Medium 6.9 Lychee: Missing Authentication for Critical Function and Allocation of Resources Without Limits or Throttling on /docs/api 0.4%
• CVE-2026-77467 High 7.1 Lychee: A single 383-byte PDF causes ~184 seconds of CPU consumption in the real processing path 0.3%
• CVE-2026-62679 High 8.9 Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read 0.4%
• CVE-2026-61838 High 8.2 Lychee: Album password bypass in ZIP downloads 0.4%
• CVE-2026-61610 Low 2.3 Lychee: unauthenticated photo starring reveals existence of private photos when photos_star_visibility=anonymous 0.3%
• CVE-2026-61611 High 7.5 Lychee: Missing rate limiting on album password unlock endpoint allows brute-force attacks 0.5%
• CVE-2026-57569 Low 2.3 Lychee: Distinct post-fix SSRF variant in Photo::fromUrl due to missing IP pinning after DNS-based validation 0.2%
• CVE-2026-57568 Medium 5.7 Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View) 0.3%
• CVE-2026-39957 Low 2.3 Lychee has Broken Access Control in SharingController::listAll() leaks private album sharing metadata to unauthorized users 0.2%
• CVE-2026-33738 Medium 4.8 Lychee Vulnerable to Stored XSS via Photo Description in RSS/Atom/JSON Feed (No Sanitization on Public Endpoint) 0.2%
• CVE-2026-33644 Low 2.3 Lychee has SSRF bypass via DNS rebinding — PhotoUrlRule only validates IP addresses, not hostnames resolving to internal IPs 0.2%
• CVE-2026-33537 Medium 5.3 Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked 0.3%
• CVE-2026-22784 Low 2.3 Lychee cross-album password propagation on Album unlocking 0.3%
• CVE-2025-53018 Low 3.0 Lychee has Server-Side Request Forgery (SSRF) in Photo::fromUrl API via unvalidated remote image URLs 0.2%
• CVE-2025-50202 High 7.5 Lychee Path Traversal Vulnerability 0.6%
• CVE-2023-52082 High 8.8 Lychee is vulnerable to an SQL Injection in explain DB queries. 0.5%