CVE-2026-62679
8.9HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-22
Impact
Authenticated users can read arbitrary files accessible to the web server process, exposing database credentials, private photos, and the APP_KEY. An attacker needs a valid login account on a deployment using specific non-default image link settings.
Root cause
SecurePathController verifies the path prefix before canonicalizing path traversal segments, allowing encoded dot segments to bypass the root check.
Affected systems
Lychee prior to 7.6.4
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade Lychee to version 7.6.4 or later. If patching immediately is not possible, mitigate by disabling temporary_image_link_enabled or enabling secure_image_link_enabled.
$ git fetch --tags && git checkout v7.6.4AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/{path}, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under the supported non-default configuration with temporary_image_link_enabled enabled, temporary_image_link_when_logged_in disabled, and secure_image_link_enabled disabled, any authenticated user can submit encoded traversal segments that pass the prefix check and are later resolved by filesystem operations. This permits reading files available to the web process, including application configuration and other users' private images, and disclosed APP_KEY or database credentials can enable further compromise. This issue is fixed in version 7.6.4.