Advisories · Technology
Lychee.
Every CVE that names Lychee among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.3 High
Lychee: Webshop payment bypass via unrestricted "Dummy" gateway selection
- Lychee
- CWE-20
- CWE-184
- CVSS 8.3 High
Lychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST request
- Lychee
- Broken access control
- CWE-20
- CVSS 6.9 Medium
Lychee: Missing Authentication for Critical Function and Allocation of Resources Without Limits or Throttling on /docs/api
- Lychee
- Denial of service
- CVSS 7.1 High
Lychee: A single 383-byte PDF causes ~184 seconds of CPU consumption in the real processing path
- Lychee
- Denial of service
- CVSS 8.9 High
Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read
- Lychee
- Path traversal
- CVSS 8.2 High
Lychee: Album password bypass in ZIP downloads
- Lychee
- Broken access control
- CVSS 2.3 Low
Lychee: unauthenticated photo starring reveals existence of private photos when photos_star_visibility=anonymous
- Lychee
- Broken access control
- CVSS 7.5 High
Lychee: Missing rate limiting on album password unlock endpoint allows brute-force attacks
- Lychee
- Authentication bypass
- CVSS 2.3 Low
Lychee: Distinct post-fix SSRF variant in Photo::fromUrl due to missing IP pinning after DNS-based validation
- Lychee
- Race condition
- Server-side request forgery (SSRF)
- CVSS 5.7 Medium
Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View)
- Lychee
- Cross-site scripting (XSS)
- CVSS 2.3 Low
Lychee has Broken Access Control in SharingController::listAll() leaks private album sharing metadata to unauthorized users
- Lychee
- Broken access control
- CVSS 4.8 Medium
Lychee Vulnerable to Stored XSS via Photo Description in RSS/Atom/JSON Feed (No Sanitization on Public Endpoint)
- Lychee
- Cross-site scripting (XSS)
- CVSS 2.3 Low
Lychee has SSRF bypass via DNS rebinding — PhotoUrlRule only validates IP addresses, not hostnames resolving to internal IPs
- Lychee
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked
- Lychee
- Server-side request forgery (SSRF)
- CVSS 2.3 Low
Lychee cross-album password propagation on Album unlocking
- Lychee
- Broken access control
- CVSS 3.0 Low
Lychee has Server-Side Request Forgery (SSRF) in Photo::fromUrl API via unvalidated remote image URLs
- Lychee
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Lychee Path Traversal Vulnerability
- Lychee
- Path traversal
- CVSS 8.8 High
Lychee is vulnerable to an SQL Injection in explain DB queries.
- Lychee
- SQL injection