Lychee EUVD-2026-102192

Exploitation requires an authenticated Lychee account (PR:L) AND the supported but non-default configuration where temporary_image_link_enabled is enabled, temporary_image_link_when_logged_in is disabled, and secure_image_link_enabled is disabled. Under default settings the vulnerable GET /image/{path} path is not reachable in this exploitable mode, which materially limits exposure. The flaw lies in SecurePathController concatenating the attacker-controlled path with the local storage root and running a string-prefix check BEFORE canonicalizing dot segments, so encoded traversal sequences (e.g. '../.env') pass validation and are later resolved by filesystem operations. Impact is bounded to files readable by the web server process (application configuration including APP_KEY/DB credentials, and other users' private images); it is a read-only disclosure with no direct write or availability effect. Fixed in 7.6.4, which adds pre-validation rejecting '..', '%2e', '%2f', and '\\' and canonicalizes via realpath().

The vendor-supplied CVSS 4.0 score of 8.9 (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H) rates this High/Critical, but several signals temper the real-world urgency. The AT:P metric explicitly encodes that exploitation requires a specific non-default configuration (temporary_image_link_enabled on, temporary_image_link_when_logged_in off, secure_image_link_enabled off), and PR:L confirms an authenticated account is required - so this is not a drive-by unauthenticated bug. No EPSS score, no CISA KEV listing, and no public exploit code were provided; a proof-of-concept traversal test case ('../.env') ships inside the vendor's own fix (SecureImageLinksTest.php), which demonstrates the mechanism but is a regression test rather than a weaponized public exploit. The vendor's VI:H/VA:N and subsequent-system SI:H/SA:H ratings appear generous for what is fundamentally an arbitrary file-READ primitive - direct impact is confidentiality (CWE-22 disclosure); the integrity/availability and subsequent-system scores are justified only by the CHAINED consequence that a leaked APP_KEY or database credentials could enable further compromise. Net assessment: a genuine confidentiality flaw worth patching, but its practical priority is moderated by the required authentication AND the required non-default configuration, which together make widespread opportunistic exploitation unlikely. Exploitation status: no public exploit identified at time of analysis.

On a Lychee instance running the specific non-default link configuration, an attacker who holds any low-privilege authenticated account sends a GET /image/{path} request whose path contains encoded directory-traversal segments. Because SecurePathController performs a string-prefix check before canonicalizing dot segments, the request escapes the storage root and the filesystem resolves it to sensitive files such as .env, disclosing the APP_KEY and database credentials as well as other users' private images. A working traversal path ('../.env') is demonstrated in the test added by the fixing commit.