Lycheeorg Lychee vulnerabilities

• lycheeorg lychee Lychee: Webshop payment bypass via unrestricted "Dummy" gateway selection CVE-2026-77466 8.3 HighOctober 15, 2026
• lycheeorg lychee Lychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST request CVE-2026-77470 8.3 HighOctober 15, 2026
• lycheeorg lychee Lychee: Missing Authentication for Critical Function and Allocation of Resources Without Limits or Throttling on /docs/api CVE-2026-77468 6.9 MediumOctober 15, 2026
• lycheeorg lychee Lychee: A single 383-byte PDF causes ~184 seconds of CPU consumption in the real processing path CVE-2026-77467 7.1 HighOctober 15, 2026
• lycheeorg lychee Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read CVE-2026-62679 8.9 HighOctober 15, 2026
• lycheeorg lychee Lychee: Album password bypass in ZIP downloads CVE-2026-61838 8.2 HighOctober 15, 2026
• lycheeorg lychee Lychee: unauthenticated photo starring reveals existence of private photos when photos_star_visibility=anonymous CVE-2026-61610 2.3 LowOctober 15, 2026
• lycheeorg lychee Lychee: Missing rate limiting on album password unlock endpoint allows brute-force attacks CVE-2026-61611 7.5 HighOctober 15, 2026
• lycheeorg lychee Lychee: Distinct post-fix SSRF variant in Photo::fromUrl due to missing IP pinning after DNS-based validation CVE-2026-57569 2.3 LowOctober 15, 2026
• lycheeorg lychee Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View) CVE-2026-57568 5.7 MediumOctober 15, 2026
• lycheeorg lychee Lychee has Broken Access Control in SharingController::listAll() leaks private album sharing metadata to unauthorized users CVE-2026-39957 2.3 LowApril 9, 2026
• lycheeorg lychee Lychee Vulnerable to Stored XSS via Photo Description in RSS/Atom/JSON Feed (No Sanitization on Public Endpoint) CVE-2026-33738 4.8 MediumMarch 26, 2026
• lycheeorg lychee Lychee has SSRF bypass via DNS rebinding — PhotoUrlRule only validates IP addresses, not hostnames resolving to internal IPs CVE-2026-33644 2.3 LowMarch 26, 2026
• lycheeorg lychee Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked CVE-2026-33537 5.3 MediumMarch 26, 2026
• lycheeorg lychee Lychee cross-album password propagation on Album unlocking CVE-2026-22784 2.3 LowJanuary 12, 2026
• lycheeorg lychee Lychee has Server-Side Request Forgery (SSRF) in Photo::fromUrl API via unvalidated remote image URLs CVE-2025-53018 3.0 LowJune 27, 2025
• lycheeorg lychee Lychee Path Traversal Vulnerability CVE-2025-50202 7.5 HighJune 18, 2025
• lycheeorg lychee Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers... CVE-2024-25808 8.3 HighMarch 22, 2024
• lycheeorg lychee Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute... CVE-2024-25807 6.1 MediumMarch 22, 2024
• lycheeorg lychee Lychee is vulnerable to an SQL Injection in explain DB queries. CVE-2023-52082 8.8 HighDecember 28, 2023
• lycheeorg lychee Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in php/Access/Guest... CVE-2021-43675 6.1 MediumDecember 15, 2021