What is the CVSS score of CVE-2025-50202?

CVE-2025-50202 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-50202?

Lychee photo-management tool versions 6.6.6-6.6.9 contain a critical path traversal flaw allowing unauthenticated attackers to read arbitrary server files, including configuration secrets and…. A patch is available.

How to fix or mitigate CVE-2025-50202?

Within 24 hours: Identify all Lychee installations and determine which are running versions 6.6.6-6.6.9; immediately isolate affected instances from production traffic if feasible or restrict network access. Within 7 days: upgrade all affected Lychee instances to version 6.6.10 or later per vendor advisory. Within 30 days: conduct file-access audit logs (if available) to determine whether the vulnerability was exploited; review exposed environment variables and secrets for unauthorized use; rotate any credentials stored in configuration files.

PHP CVE-2025-50202

EUVD-2025-18624 HIGH

Path Traversal (CWE-22)

2025-06-18 security-advisories@github.com

PHP Nginx Path Traversal

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:37 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

6.6.10

EUVD ID Assigned

Mar 14, 2026 - 22:49 euvd

EUVD-2025-18624

Analysis Generated

Mar 14, 2026 - 22:49 vuln.today

CVE Published

Jun 18, 2025 - 05:15 nvd

HIGH 7.5

DescriptionGitHub Advisory

Lychee is a free photo-management tool. In versions starting from 6.6.6 to before 6.6.10, an attacker can leak local files including environment variables, nginx logs, other user's uploaded images, and configuration secrets due to a path traversal exploit in SecurePathController.php. This issue has been patched in version 6.6.10.

AnalysisAI

Path traversal vulnerability in Lychee photo-management tool (versions 6.6.6 through 6.6.9) that allows unauthenticated remote attackers to read arbitrary files from the server, including environment variables, configuration secrets, nginx logs, and other users' uploaded images. The vulnerability exists in SecurePathController.php and has a CVSS score of 7.5 (high severity) with straightforward network-based exploitation requiring no authentication or user interaction. A patch is available in version 6.6.10.

Technical ContextAI

Lychee is a self-hosted photo management and sharing application built on PHP. The vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal), indicating that the SecurePathController.php component fails to properly sanitize or validate user-supplied path parameters before using them in file system operations. Affected versions 6.6.6 through 6.6.9 contain insufficient input validation that allows attackers to traverse directory structures using path traversal sequences (e.g., '../../../') to access files outside the intended directory boundaries. The vulnerability likely affects the file serving/retrieval mechanisms used by Lychee to manage and access stored images and application files, potentially exposing the entire server filesystem depending on the PHP process permissions and web server configuration.

RemediationAI

Immediate remediation: (1) Upgrade to Lychee version 6.6.10 or later, which contains the security patch addressing the path traversal vulnerability in SecurePathController.php; (2) If immediate upgrade is not possible, implement network-level access controls to restrict access to the Lychee application to trusted IP addresses only; (3) Implement Web Application Firewall (WAF) rules to detect and block path traversal attempts (patterns like '../', '..\', URL-encoded variants '%2e%2e%2f'); (4) Review web server logs and any accessible files for evidence of exploitation; (5) Rotate all credentials, API keys, and secrets that may have been exposed through environment variable leakage; (6) Audit file permissions to ensure the web server process runs with minimal necessary privileges. Vendor advisory and patch details available from Lychee GitHub repository (https://github.com/LycheeOrg/Lychee).