EUVD-2026-75209
GHSA-gvv2-7gf7-286x
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network endpoint (PR:N/UI:N/AV:N/AC:L) allowing attacker-controlled file and path yields webshell RCE, giving full C:H/I:H/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. Unauthenticated remote attackers can upload arbitrary files and write them outside the intended storage directory via the directory parameter in POST /app-api/infra/file/upload.
AnalysisAI
Arbitrary file upload with path traversal in LZ-litchi 1.0.0 lets remote unauthenticated attackers write attacker-controlled files to locations outside the intended storage directory by manipulating the 'directory' parameter of POST /app-api/infra/file/upload. Because uploaded content and destination path are both attacker-controlled, an attacker can plant a web-executable payload and achieve code execution on the host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the application expose the POST /app-api/infra/file/upload endpoint reachable over the network and honor a client-supplied 'directory' parameter that is used to build the write path - both present in default LZ-litchi 1.0.0 per the description. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, score 9.8) describes a trivially reachable, unauthenticated network attack with full confidentiality/integrity/availability impact - consistent with an unauth upload-to-webshell primitive. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis, and no fixed version is cited in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today