Lychee
Monthly
Paid fulfillment bypass in Lychee (Supporter/Pro editions) before 7.7.0: the checkout validators accept any OmnipayProviderType enum value, including the Dummy test gateway that is deliberately hidden from production checkout, so a remote unauthenticated buyer - where webshop_allow_guest_checkout is enabled - can start and finalize a session against the Dummy gateway and, with webshop_auto_fulfill_enabled on, have OrderCompletedListener::fullfillOrder() release the purchasable item without any real payment. The integrity impact is genuine but conditional (CVSS 4.0 base 8.3 with Attack Requirements: Present; assessed CVSS 3.1 8.3, C:L/I:H/A:N), since exploitation requires a paid Supporter/Pro instance running the webshop with at least one enabled purchasable item and the relevant opt-in flags. No public exploit identified at time of analysis, and the vendor has released a fixed version, 7.7.0.
Unauthenticated buyers on Lychee instances running the Supporter/Pro webshop can tamper with the parameters handed to the payment gateway, overriding the server-computed amount, currency, returnUrl, cancelUrl, or transactionId so that a gateway approves a payment for an attacker-chosen price while the merchant is underpaid and auto-fulfilled goods are still delivered. The flaw lives in CheckoutService::preparePurchaseParameters(), which merges the client-supplied additional_data array after the server's own purchase parameters, allowing later string keys to overwrite earlier ones before processPayment() reaches a non-PayPal Omnipay gateway. Exploitation is not a network-wide exposure: it requires an enabled webshop, at least one purchasable item, and an affected Omnipay gateway (PayPal is explicitly not affected), which sharply narrows the population at risk; no public exploit code was identified at time of analysis, though the upstream fix ships a regression test that demonstrates the parameter override, and no CISA KEV entry exists. This is best treated as a credible, prioritizable business-logic flaw rather than an inflated high-severity issue, since the integrity impact on the merchant's billing is real but the prerequisites are opt-in and non-default.
Denial of service in Lychee before 7.7.0 allows an authenticated user with upload/import permission to tie up image-processing capacity by submitting a tiny PDF whose first page declares an oversized /MediaBox. Lychee hands PDFs to ImageMagick with Ghostscript enabled and applies no pre-render page-size check in ImagickHandler::loadPdf(), so Ghostscript burns CPU rasterizing an enormous page before the pixel-cache policy rejects the result; in synchronous QUEUE_CONNECTION deployments a single request occupies a web worker, while the official asynchronous Docker setup instead backs up the shared image-processing queue and delays other users' work. Exploitation is gated behind authentication, only availability is affected (no confidentiality, integrity, or Ghostscript sandbox-escape impact), and no public exploit was identified at time of analysis. The vendor/CNA scored this 7.1 under CVSS 4.0, whereas the independent assessment rates the same issue CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L (4.3), reflecting limited per-request availability impact.
Authenticated path traversal in Lychee photo-management tool prior to 7.6.4 allows any logged-in user to read files accessible to the web process - including the application's .env file with APP_KEY and database credentials, and other users' private images - by sending encoded traversal segments to GET /image/{path}. Exploitation is not unconditional: it requires the supported but non-default configuration with temporary_image_link_enabled on and both temporary_image_link_when_logged_in and secure_image_link_enabled off, so default installations do not expose the vulnerable code path in an exploitable state. The impact is read-only information disclosure (no write or availability effect) and disclosure of APP_KEY or DB credentials can escalate to further compromise; no public exploit was identified at time of analysis, and the vendor fixed the flaw in 7.6.4.
Unauthenticated attackers who know the shared identifier of a public, password-protected Lychee album can pull down a ZIP archive of the album's photos via GET /api/v2/Zip without ever supplying the album password, because the download authorization path never re-checks album access. All versions prior to 7.6.3 are affected, and the exposure escalates to full-resolution originals plus associated metadata when the album's grants_full_photo_access flag is also enabled. The flaw only triggers on a non-default sharing configuration (public + password-protected + grants_download on), and no public exploit identified at time of analysis; the vendor fix is 7.6.3.
Lychee photo-management instances running versions prior to 7.6.1 expose POST /api/v2/Album::unlock with no throttle, attempt counter, backoff, CAPTCHA, or lockout, letting remote unauthenticated attackers (CVSS PR:N, no user interaction) automate password guessing against password-protected albums. Successful recovery of an album password grants access to that album's otherwise private photo collection, so the realistic impact is concentrated on albums secured with weak or common passwords, since high-entropy passwords resist brute-forcing even with unlimited attempts. The fix is available in Lychee 7.6.1, which adds rate-limiting middleware to the unlock route; no public exploit is identified at time of analysis, and exploitation is bounded by the need to know or obtain a valid album identifier and by the strength of the album password.
Unauthenticated remote attackers can retrieve a complete OpenAPI schema and repeatedly force CPU-intensive schema regeneration on Lychee photo-management installations before version 7.7.0. The GET /docs/api route is exposed by default after installation, lacks authentication and rate limiting, and regenerates the Scramble-generated documentation on every request, enabling both API-surface disclosure and server resource exhaustion. This is a medium-severity resource-exhaustion issue (CWE-770) with bounded impact-no code execution or data compromise-and no public exploit code or confirmed active exploitation identified at time of analysis.
Improper access control in Lychee before 7.6.1 allows remote attackers to probe for and alter the highlight (star) state of photos they are not permitted to see, including photos in private or password-protected albums. The flaw only exists on installations configured with the non-default setting photos_star_visibility set to 'anonymous', where PhotoPolicy::canHighlight() returns true for callers without performing a canSee check, and SetPhotosHighlightedRequest::processValidatedValues() runs before authorization. Impact is narrow - existence disclosure via differing success/not-found responses plus toggling of is_highlighted - with no read of photo content, no deletion and no availability impact; exploitation additionally requires guessing valid photo identifiers, and no public exploit code has been identified at time of analysis (no CISA KEV listing). Note the source description labels the attacker 'unauthenticated' while the supplied CVSS 4.0 vector carries PR:L, and our independent assessment scores it PR:N, so authentication requirements are not fully confirmed from available data and should be verified with the vendor.
Server-side request forgery in the Lychee photo-management tool before 7.6.0 lets an authenticated user who can reach the POST /api/v2/Photo::fromUrl URL-import endpoint steer server-side fetches toward private or otherwise forbidden destinations by manipulating DNS answers between the validation step and the download step. The flaw is a classic time-of-check to time-of-use (CWE-367) DNS-rebinding race: app/Rules/PhotoUrlRule.php resolves and approves the submitted hostname, but app/Actions/Import/FromUrl.php later passes the original hostname to app/Image/Files/DownloadedFile.php, which opens a completely separate connection and resolves that hostname again, so an attacker controlling authoritative DNS for the name can return a public address to the check and a private address to the fetch. Exploitation requires a valid Lychee account (PR:L) and precise timing against the second resolution (AC:H), and real-world impact is bounded by which internal services the Lychee host can actually reach and by TLS behavior on the fetched connection, as the vendor advisory notes; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Stored cross-site scripting in Lychee photo-management software (all versions prior to 7.6.0) allows an authenticated user holding album-edit permissions to embed a javascript: URI inside an album or photo Markdown description, which is then converted to HTML server-side and rendered client-side via v-html in the gallery components. Because the payload is stored in album/photo metadata, any visitor who clicks the rendered link - including an unauthenticated visitor to a public album - executes attacker-controlled JavaScript in the Lychee origin, which can expose session data or let the attacker issue authenticated requests in the victim's context; exploitation requires the victim's click and therefore is not triggered by passive page views. The issue is fixed in Lychee 7.6.0 and no public exploit was identified at time of analysis.
SQL operator-precedence bug in Lychee prior to 7.5.4 allows authenticated users with upload permission to bypass ownership filters and retrieve all user-group-based sharing permissions across the instance, including private albums owned by other users. The vulnerability exists in SharingController::listAll() where an orWhereNotNull clause escapes the ownership filter applied by a when() block. This affects any non-admin user who owns at least one album, creating an information disclosure risk that exposes sharing metadata for the entire Lychee instance.
Stored cross-site scripting (XSS) in Lychee photo-management application versions prior to 7.5.3 allows unauthenticated remote attackers to execute arbitrary JavaScript through unsanitized photo description fields rendered in publicly accessible RSS, Atom, and JSON feed endpoints. The vulnerability stems from use of Blade's unescaped output syntax ({!! !!}) in feed templates, enabling malicious descriptions to inject executable scripts that execute in the context of any RSS reader or client consuming the feed.
DNS rebinding bypasses SSRF protection in Lychee photo-management tool versions prior to 7.5.2, allowing authenticated remote attackers to access restricted internal resources by providing domain names instead of IP addresses to the photo URL import feature. The vulnerability exploits a logic flaw in PhotoUrlRule.php where hostname validation only applies to IP addresses, leaving domain-based requests unvalidated. Vendor-released patch available (version 7.5.2); no public exploit identified at time of analysis.
Incomplete IP validation in Lychee's SSRF protection mechanism allows authenticated users to bypass all four security configuration settings by leveraging loopback and link-local addresses, enabling access to internal services. The vulnerability affects Lychee versions prior to 7.5.1 and requires prior authentication but carries low confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis, though the attack vector is network-accessible and requires minimal complexity.
Lychee photo management tool versions before 7.1.0 contain an authorization bypass in the album password unlock mechanism that allows authenticated users to access multiple password-protected albums by unlocking just one that shares the same password. Public exploit code exists for this vulnerability. Administrators should upgrade to version 7.1.0 or later to prevent unauthorized access to protected photo collections.
Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create new album function. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title parameter when creating an album. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Lychee is a free photo-management tool. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in php/Access/Guest.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Paid fulfillment bypass in Lychee (Supporter/Pro editions) before 7.7.0: the checkout validators accept any OmnipayProviderType enum value, including the Dummy test gateway that is deliberately hidden from production checkout, so a remote unauthenticated buyer - where webshop_allow_guest_checkout is enabled - can start and finalize a session against the Dummy gateway and, with webshop_auto_fulfill_enabled on, have OrderCompletedListener::fullfillOrder() release the purchasable item without any real payment. The integrity impact is genuine but conditional (CVSS 4.0 base 8.3 with Attack Requirements: Present; assessed CVSS 3.1 8.3, C:L/I:H/A:N), since exploitation requires a paid Supporter/Pro instance running the webshop with at least one enabled purchasable item and the relevant opt-in flags. No public exploit identified at time of analysis, and the vendor has released a fixed version, 7.7.0.
Unauthenticated buyers on Lychee instances running the Supporter/Pro webshop can tamper with the parameters handed to the payment gateway, overriding the server-computed amount, currency, returnUrl, cancelUrl, or transactionId so that a gateway approves a payment for an attacker-chosen price while the merchant is underpaid and auto-fulfilled goods are still delivered. The flaw lives in CheckoutService::preparePurchaseParameters(), which merges the client-supplied additional_data array after the server's own purchase parameters, allowing later string keys to overwrite earlier ones before processPayment() reaches a non-PayPal Omnipay gateway. Exploitation is not a network-wide exposure: it requires an enabled webshop, at least one purchasable item, and an affected Omnipay gateway (PayPal is explicitly not affected), which sharply narrows the population at risk; no public exploit code was identified at time of analysis, though the upstream fix ships a regression test that demonstrates the parameter override, and no CISA KEV entry exists. This is best treated as a credible, prioritizable business-logic flaw rather than an inflated high-severity issue, since the integrity impact on the merchant's billing is real but the prerequisites are opt-in and non-default.
Denial of service in Lychee before 7.7.0 allows an authenticated user with upload/import permission to tie up image-processing capacity by submitting a tiny PDF whose first page declares an oversized /MediaBox. Lychee hands PDFs to ImageMagick with Ghostscript enabled and applies no pre-render page-size check in ImagickHandler::loadPdf(), so Ghostscript burns CPU rasterizing an enormous page before the pixel-cache policy rejects the result; in synchronous QUEUE_CONNECTION deployments a single request occupies a web worker, while the official asynchronous Docker setup instead backs up the shared image-processing queue and delays other users' work. Exploitation is gated behind authentication, only availability is affected (no confidentiality, integrity, or Ghostscript sandbox-escape impact), and no public exploit was identified at time of analysis. The vendor/CNA scored this 7.1 under CVSS 4.0, whereas the independent assessment rates the same issue CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L (4.3), reflecting limited per-request availability impact.
Authenticated path traversal in Lychee photo-management tool prior to 7.6.4 allows any logged-in user to read files accessible to the web process - including the application's .env file with APP_KEY and database credentials, and other users' private images - by sending encoded traversal segments to GET /image/{path}. Exploitation is not unconditional: it requires the supported but non-default configuration with temporary_image_link_enabled on and both temporary_image_link_when_logged_in and secure_image_link_enabled off, so default installations do not expose the vulnerable code path in an exploitable state. The impact is read-only information disclosure (no write or availability effect) and disclosure of APP_KEY or DB credentials can escalate to further compromise; no public exploit was identified at time of analysis, and the vendor fixed the flaw in 7.6.4.
Unauthenticated attackers who know the shared identifier of a public, password-protected Lychee album can pull down a ZIP archive of the album's photos via GET /api/v2/Zip without ever supplying the album password, because the download authorization path never re-checks album access. All versions prior to 7.6.3 are affected, and the exposure escalates to full-resolution originals plus associated metadata when the album's grants_full_photo_access flag is also enabled. The flaw only triggers on a non-default sharing configuration (public + password-protected + grants_download on), and no public exploit identified at time of analysis; the vendor fix is 7.6.3.
Lychee photo-management instances running versions prior to 7.6.1 expose POST /api/v2/Album::unlock with no throttle, attempt counter, backoff, CAPTCHA, or lockout, letting remote unauthenticated attackers (CVSS PR:N, no user interaction) automate password guessing against password-protected albums. Successful recovery of an album password grants access to that album's otherwise private photo collection, so the realistic impact is concentrated on albums secured with weak or common passwords, since high-entropy passwords resist brute-forcing even with unlimited attempts. The fix is available in Lychee 7.6.1, which adds rate-limiting middleware to the unlock route; no public exploit is identified at time of analysis, and exploitation is bounded by the need to know or obtain a valid album identifier and by the strength of the album password.
Unauthenticated remote attackers can retrieve a complete OpenAPI schema and repeatedly force CPU-intensive schema regeneration on Lychee photo-management installations before version 7.7.0. The GET /docs/api route is exposed by default after installation, lacks authentication and rate limiting, and regenerates the Scramble-generated documentation on every request, enabling both API-surface disclosure and server resource exhaustion. This is a medium-severity resource-exhaustion issue (CWE-770) with bounded impact-no code execution or data compromise-and no public exploit code or confirmed active exploitation identified at time of analysis.
Improper access control in Lychee before 7.6.1 allows remote attackers to probe for and alter the highlight (star) state of photos they are not permitted to see, including photos in private or password-protected albums. The flaw only exists on installations configured with the non-default setting photos_star_visibility set to 'anonymous', where PhotoPolicy::canHighlight() returns true for callers without performing a canSee check, and SetPhotosHighlightedRequest::processValidatedValues() runs before authorization. Impact is narrow - existence disclosure via differing success/not-found responses plus toggling of is_highlighted - with no read of photo content, no deletion and no availability impact; exploitation additionally requires guessing valid photo identifiers, and no public exploit code has been identified at time of analysis (no CISA KEV listing). Note the source description labels the attacker 'unauthenticated' while the supplied CVSS 4.0 vector carries PR:L, and our independent assessment scores it PR:N, so authentication requirements are not fully confirmed from available data and should be verified with the vendor.
Server-side request forgery in the Lychee photo-management tool before 7.6.0 lets an authenticated user who can reach the POST /api/v2/Photo::fromUrl URL-import endpoint steer server-side fetches toward private or otherwise forbidden destinations by manipulating DNS answers between the validation step and the download step. The flaw is a classic time-of-check to time-of-use (CWE-367) DNS-rebinding race: app/Rules/PhotoUrlRule.php resolves and approves the submitted hostname, but app/Actions/Import/FromUrl.php later passes the original hostname to app/Image/Files/DownloadedFile.php, which opens a completely separate connection and resolves that hostname again, so an attacker controlling authoritative DNS for the name can return a public address to the check and a private address to the fetch. Exploitation requires a valid Lychee account (PR:L) and precise timing against the second resolution (AC:H), and real-world impact is bounded by which internal services the Lychee host can actually reach and by TLS behavior on the fetched connection, as the vendor advisory notes; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Stored cross-site scripting in Lychee photo-management software (all versions prior to 7.6.0) allows an authenticated user holding album-edit permissions to embed a javascript: URI inside an album or photo Markdown description, which is then converted to HTML server-side and rendered client-side via v-html in the gallery components. Because the payload is stored in album/photo metadata, any visitor who clicks the rendered link - including an unauthenticated visitor to a public album - executes attacker-controlled JavaScript in the Lychee origin, which can expose session data or let the attacker issue authenticated requests in the victim's context; exploitation requires the victim's click and therefore is not triggered by passive page views. The issue is fixed in Lychee 7.6.0 and no public exploit was identified at time of analysis.
SQL operator-precedence bug in Lychee prior to 7.5.4 allows authenticated users with upload permission to bypass ownership filters and retrieve all user-group-based sharing permissions across the instance, including private albums owned by other users. The vulnerability exists in SharingController::listAll() where an orWhereNotNull clause escapes the ownership filter applied by a when() block. This affects any non-admin user who owns at least one album, creating an information disclosure risk that exposes sharing metadata for the entire Lychee instance.
Stored cross-site scripting (XSS) in Lychee photo-management application versions prior to 7.5.3 allows unauthenticated remote attackers to execute arbitrary JavaScript through unsanitized photo description fields rendered in publicly accessible RSS, Atom, and JSON feed endpoints. The vulnerability stems from use of Blade's unescaped output syntax ({!! !!}) in feed templates, enabling malicious descriptions to inject executable scripts that execute in the context of any RSS reader or client consuming the feed.
DNS rebinding bypasses SSRF protection in Lychee photo-management tool versions prior to 7.5.2, allowing authenticated remote attackers to access restricted internal resources by providing domain names instead of IP addresses to the photo URL import feature. The vulnerability exploits a logic flaw in PhotoUrlRule.php where hostname validation only applies to IP addresses, leaving domain-based requests unvalidated. Vendor-released patch available (version 7.5.2); no public exploit identified at time of analysis.
Incomplete IP validation in Lychee's SSRF protection mechanism allows authenticated users to bypass all four security configuration settings by leveraging loopback and link-local addresses, enabling access to internal services. The vulnerability affects Lychee versions prior to 7.5.1 and requires prior authentication but carries low confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis, though the attack vector is network-accessible and requires minimal complexity.
Lychee photo management tool versions before 7.1.0 contain an authorization bypass in the album password unlock mechanism that allows authenticated users to access multiple password-protected albums by unlocking just one that shares the same password. Public exploit code exists for this vulnerability. Administrators should upgrade to version 7.1.0 or later to prevent unauthorized access to protected photo collections.
Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create new album function. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title parameter when creating an album. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Lychee is a free photo-management tool. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in php/Access/Guest.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.