211 matches found
CVE-2026-57568 Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View)
Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to store a javascript URI in an album or photo Markdown description because config/markdown.php enables allowunsafelinks...
CVE-2026-57568
The photo-management tool Lychee is vulnerable to Stored XSS in versions prior to 7.6.0 . The root cause is that config/markdown.php enables allow_unsafe_links, allowing authenticated users with album-edit permissions to store javascript: URIs in photo or album Markdown descriptions. These descri...
PT-2026-115026
Name of the Vulnerable Software and Affected Versions Lychee versions prior to 7.7.0 Description An issue exists where the software enables ImageMagick PDF support via Ghostscript without applying an effective pre-render limit to PDF page dimensions in the loadPdf function of ImagickHandler. An...
CVE-2026-62679: Improper Limitation of a Pathname to a Restricted Directory
Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/path, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under the supported non-default...
CVE-2026-77468: Allocation of Resources Without Limits or Throttling
Lychee is a free, open-source photo-management tool. Prior to 7.7.0, GET /docs/api exposes the Scramble-generated OpenAPI documentation configured by config/scramble.php to unauthenticated callers after installation, with observed response size and latency suggesting that the schema is regenerate...
CVE-2026-77467: Uncontrolled Resource Consumption
Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee enables ImageMagick PDF support with Ghostscript but does not apply an effective pre-render limit to PDF page dimensions in ImagickHandler::loadPdf. An authenticated user who can upload a small PDF with an oversized...
CVE-2026-61838: Improper Authorization
Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload and PhotoPolicy::canDownload without first enforcing AlbumPolicy::canAccess. For a public, password-protected album with grantsdownload enabled...
CVE-2026-57569: Time-of-check Time-of-use (TOCTOU) Race Condition
Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Actions/Import/FromUrl.php to app/Image/Files/DownloadedFile.p...
CVE-2026-57568: Improper Neutralization of Input During Web Page Generation
Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to store a javascript URI in an album or photo Markdown description because config/markdown.php enables allowunsafelinks...
PT-2026-115021
Name of the Vulnerable Software and Affected Versions Lychee versions prior to 7.6.1 Description An issue exists when the photos star visibility setting is configured as anonymous. An unauthenticated attacker who can guess photo identifiers can use the 'POST /api/v2/Photo::highlight' endpoint to...
CVE-2026-61610: Improper Access Control
Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photosstarvisibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a photo without confirming that the caller can see it. BaseApiRequest::validateResolved invokes...
CVE-2026-77466: Improper Input Validation
Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::getsupportedproviders, but CreateSessionRequest validates only that the submitted provider is an OmnipayProviderType an...
CVE-2026-61611: Improper Restriction of Excessive Authentication Attempts
Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA, or lockout. UnlockAlbumRequest::authorize permits any caller to submit attempts, and app/Actions/Album/Unlock.php verifies each guess with Hash::chec...
CVE-2026-77470: Improper Input Validation
Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additionaldata array and CheckoutService::preparePurchaseParameters merges it after server-computed purchase parameters. Because later...
GO-2025-3678 vulnerabilities
Vulnerabilities for packages: linkerd2-proxy, kdash, qdrant, sccache, sqlx, wasmtime, wash, rustls-ffi, cargo-audit, samply, parseable, deno, rye, xh, zola, atuin, shadowsocks-rust, buck2, zed, lychee, wasmcloud, nushell, oranda, zizmor, ntpd-rs, rustup, linkerd-extension-init, wasm-pack, uv, pix...
Lychee Installer Detection
Lychee is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Lychee is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...
Malicious Package
Overview lychee-norm-cache is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious code in lychee-norm-cache (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23ee684fa7edabc6e34aedc6e32e36c42fb68100a69908227e639d53592565de lychee-norm-cache is a dependency-confusion proof-of-concept that provides no functional utility. Its bin script POSTs a small JSON payload containin...
MAL-2026-11029 Malicious code in lychee-norm-cache (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23ee684fa7edabc6e34aedc6e32e36c42fb68100a69908227e639d53592565de lychee-norm-cache is a dependency-confusion proof-of-concept that provides no functional utility. Its bin script POSTs a small JSON payload containin...
