Lycheeorg
Lycheeorg Lychee: vulnerabilidades y CVE
Lycheeorg Lychee tiene 12 vulnerabilidades publicadas, 5 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE12
Últimos 12 meses5
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-39957 | Baja (2.3) | 0.33% | — | 9 abr 2026 | Lychee is a free, open-source photo-management tool. Prior to 7.5.4, a SQL operator-precedence bug in SharingController::listAll() causes the orWhereNotNull('user_group_id') clause to escape the ownership filter applied… |
| CVE-2026-33738 | Media (4.8) | 0.36% | — | 26 mar 2026 | Lychee is a free, open-source photo-management tool. Prior to version 7.5.3, the photo `description` field is stored without HTML sanitization and rendered using `{!! $item->summary !!}` (Blade unescaped output) in the… |
| CVE-2026-33644 | Baja (2.3) | 0.30% | — | 26 mar 2026 | Lychee is a free, open-source photo-management tool. Prior to version 7.5.2, the SSRF protection in `PhotoUrlRule.php` can be bypassed using DNS rebinding. The IP validation check (line 86-89) only activates when the… |
| CVE-2026-33537 | Media (5.3) | 0.30% | — | 26 mar 2026 | Lychee is a free, open-source photo-management tool. The patch introduced for GHSA-cpgw-wgf3-xc6v (SSRF via `Photo::fromUrl`) contains an incomplete IP validation check that fails to block loopback addresses and… |
| CVE-2026-22784 | Baja (2.3) | 0.27% | — | 12 ene 2026 | Lychee is a free, open-source photo-management tool. Prior to 7.1.0, an authorization vulnerability exists in Lychee's album password unlock functionality that allows users to gain possibly unauthorized access to other… |
| CVE-2024-48908 | Media (6.9) | 0.39% | — | 28 ago 2025 | lychee link checking action checks links in Markdown, HTML, and text files using lychee. Prior to version 2.0.2, there is a potential attack of arbitrary code injection vulnerability in lychee-setup of the composite… |
| CVE-2025-53018 | Baja (3) | 0.20% | — | 27 jun 2025 | Lychee is a free, open-source photo-management tool. Prior to version 6.6.13, a critical Server-Side Request Forgery (SSRF) vulnerability exists in the `/api/v2/Photo::fromUrl` endpoint. This flaw lets an attacker… |
| CVE-2025-50202 | Alta (7.5) | 0.62% | — | 18 jun 2025 | Lychee is a free photo-management tool. In versions starting from 6.6.6 to before 6.6.10, an attacker can leak local files including environment variables, nginx logs, other user's uploaded images, and configuration… |
| CVE-2024-25808 | Alta (8.3) | 0.38% | — | 22 mar 2024 | Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create new album function. |
| CVE-2024-25807 | Media (6.1) | 0.46% | — | 22 mar 2024 | Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title parameter when creating an album. |
| CVE-2023-52082 | Crítica (9.8) | 0.47% | — | 28 dic 2023 | Lychee is a free photo-management tool. Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the `.env` settings set to… |
| CVE-2021-43675 | Media (6.1) | 0.85% | — | 15 dic 2021 | Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in php/Access/Guest.php. The function exit will terminate the script and print the message to the user. The message will contain albumID which… |