Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
22 results
Oct 15, 2026Lychee is a free, open-source photo-management tool.CVE-2026-77470 · Other software · LycheeOrg · reported by GitHubHigh 8.3
Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array and CheckoutService::preparePurchaseParameters() merges it after server-computed purchase parameters. Because later string keys overwrite earlier keys, an unauthenticated buyer can replace amount, currency, returnUrl, cancelUrl, or transactionId before CheckoutService::processPayment() passes the parameters to a non-PayPal Omnipay gateway. An attacker can therefore make a gateway accept a successful payment for an attacker-selected amount and obtain auto-fulfilled goods while underpaying the merchant. The issue requires an enabled webshop, a purchasable item, and an affected Omnipay gateway. This issue is fixed in version 7.7.1.
- Product
- Lychee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Lychee is a free, open-source photo-management tool.CVE-2026-77468 · Other software · LycheeOrg · reported by GitHubMedium 6.9
Lychee is a free, open-source photo-management tool. Prior to 7.7.0, GET /docs/api exposes the Scramble-generated OpenAPI documentation configured by config/scramble.php to unauthenticated callers after installation, with observed response size and latency suggesting that the schema is regenerated without an application-level cache. A remote attacker can repeatedly request the unthrottled route to consume server CPU and obtain a detailed map of the API surface and parameter schema. This issue is fixed in version 7.7.0.
- Product
- Lychee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Lychee is a free, open-source photo-management tool.CVE-2026-77467 · Other software · LycheeOrg · reported by GitHubHigh 7.1
Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee enables ImageMagick PDF support with Ghostscript but does not apply an effective pre-render limit to PDF page dimensions in ImagickHandler::loadPdf(). An authenticated user who can upload a small PDF with an oversized /MediaBox can cause Imagick::readImage() to consume substantial CPU before failing to produce an image. When QUEUE_CONNECTION selects synchronous processing the request can occupy a web worker, while the official asynchronous Docker configuration can clog the shared image-processing queue and delay other work. The advisory did not identify a Ghostscript sandbox escape. This issue is fixed in version 7.7.0.
- Product
- Lychee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Lychee is a free, open-source photo-management tool.CVE-2026-77466 · Other software · LycheeOrg · reported by GitHubHigh 8.3
Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::get_supported_providers(), but CreateSessionRequest validates only that the submitted provider is an OmnipayProviderType and does not enforce OmnipayProviderType::isAllowed(). A buyer, including a guest when webshop_allow_guest_checkout is enabled, can submit Dummy directly and complete the test gateway flow without a real payment. When webshop_auto_fulfill_enabled is enabled, OrderCompletedListener::fullfillOrder() can then release the purchasable item. The issue requires access to the Supporter or Pro webshop and an enabled purchasable item. Testing bypassed the closed-source license middleware, so whether the real license layer performs additional payment-provider validation remains unverified. The payment finalize status check itself is not the root cause. This issue is fixed in version 7.7.0.
- Product
- Lychee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Lychee is a free, open-source photo-management tool.CVE-2026-62679 · Other software · LycheeOrg · reported by GitHubHigh 8.9
Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/{path}, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under the supported non-default configuration with temporary_image_link_enabled enabled, temporary_image_link_when_logged_in disabled, and secure_image_link_enabled disabled, any authenticated user can submit encoded traversal segments that pass the prefix check and are later resolved by filesystem operations. This permits reading files available to the web process, including application configuration and other users' private images, and disclosed APP_KEY or database credentials can enable further compromise. This issue is fixed in version 7.6.4.
- Product
- Lychee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Lychee is a free, open-source photo-management tool.CVE-2026-61838 · Other software · LycheeOrg · reported by GitHubHigh 8.2
Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload() and PhotoPolicy::canDownload() without first enforcing AlbumPolicy::canAccess(). For a public, password-protected album with grants_download enabled, an unauthenticated attacker who knows the shared album identifier can download a ZIP archive without supplying the password or unlocking the album, even though browsing endpoints deny access. The archive exposes the album's photos and can include full-resolution originals and associated metadata when grants_full_photo_access is enabled. This issue is fixed in version 7.6.3.
- Product
- Lychee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Lychee is a free, open-source photo-management tool.CVE-2026-61611 · Other software · LycheeOrg · reported by GitHubHigh 7.5
Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA, or lockout. UnlockAlbumRequest::authorize() permits any caller to submit attempts, and app/Actions/Album/Unlock.php verifies each guess with Hash::check without limiting repeated failures. A remote unauthenticated attacker who knows or can obtain an album identifier can automate password guesses against a password-protected album and, if the password is recovered, gain access to its private photo collection. This issue is fixed in version 7.6.1.
- Product
- Lychee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Lychee is a free, open-source photo-management tool.CVE-2026-61610 · Other software · LycheeOrg · reported by GitHubLow 2.3
Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photos_star_visibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a photo without confirming that the caller can see it. BaseApiRequest::validateResolved() invokes SetPhotosHighlightedRequest::processValidatedValues() before authorization, and PhotoPolicy::canHighlight() returns true for anonymous callers without a canSee check. An unauthenticated attacker who can guess photo identifiers can distinguish existing private photos through differing success and not-found responses and can change their is_highlighted state, including for photos in private or password-protected albums. The issue is limited to installations using the non-default anonymous star-visibility setting. This issue is fixed in version 7.6.1.
- Product
- Lychee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Lychee is a free, open-source photo-management tool.CVE-2026-57569 · Other software · LycheeOrg · reported by GitHubLow 2.3
Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Actions/Import/FromUrl.php to app/Image/Files/DownloadedFile.php for a separate fopen connection. An authenticated attacker who controls DNS responses can cause validation to observe a public address and the subsequent fetch to resolve the same hostname to a private or otherwise forbidden address. This DNS rebinding time-of-check to time-of-use mismatch bypasses the intended server-side request forgery protections and can reach services available from the Lychee server, subject to deployment and TLS behavior. This issue is fixed in version 7.6.0.
- Product
- Lychee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Lychee is a free, open-source photo-management tool.CVE-2026-57568 · Other software · LycheeOrg · reported by GitHubMedium 5.7
Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to store a javascript URI in an album or photo Markdown description because config/markdown.php enables allow_unsafe_links. app/Http/Resources/Models/Utils/PreformattedPhotoData.php and app/Http/Resources/Models/Utils/PreFormattedAlbumData.php convert the description to HTML, and the gallery components PhotoDetails.vue, Overlay.vue, PhotoThumb.vue, AlbumHero.vue, and AlbumCard.vue render that HTML with v-html. A visitor, including an unauthenticated visitor to a public album, who clicks the rendered link executes attacker-controlled JavaScript in the Lychee origin, which can expose session data or enable authenticated requests in the victim's context. This gallery-view flaw is distinct from CVE-2026-33738, which addressed feed rendering. This issue is fixed in version 7.6.0.
- Product
- Lychee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026Lychee is a free, open-source photo-management tool.CVE-2026-39957 · Other software · LycheeOrg · reported by GitHubLow 2.3
Lychee is a free, open-source photo-management tool. Prior to 7.5.4, a SQL operator-precedence bug in SharingController::listAll() causes the orWhereNotNull('user_group_id') clause to escape the ownership filter applied by the when() block. Any authenticated non-admin user with upload permission who owns at least one album can retrieve all user-group-based sharing permissions across the entire instance, including private albums owned by other users. This vulnerability is fixed in 7.5.4.
- Product
- Lychee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Lychee is a free, open-source photo-management tool.CVE-2026-33738 · Other software · LycheeOrg · reported by GitHubMedium 4.8
Lychee is a free, open-source photo-management tool. Prior to version 7.5.3, the photo `description` field is stored without HTML sanitization and rendered using `{!! $item->summary !!}` (Blade unescaped output) in the RSS, Atom, and JSON feed templates. The `/feed` endpoint is publicly accessible without authentication, allowing any RSS reader to execute attacker-controlled JavaScript. Version 7.5.3 fixes the issue.
- Product
- Lychee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Lychee is a free, open-source photo-management tool.CVE-2026-33644 · Other software · LycheeOrg · reported by GitHubLow 2.3
Lychee is a free, open-source photo-management tool. Prior to version 7.5.2, the SSRF protection in `PhotoUrlRule.php` can be bypassed using DNS rebinding. The IP validation check (line 86-89) only activates when the hostname is an IP address. When a domain name is used, `filter_var($host, FILTER_VALIDATE_IP)` returns `false`, skipping the entire check. Version 7.5.2 patches the issue.
- Product
- Lychee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Lychee is a free, open-source photo-management tool.CVE-2026-33537 · Other software · LycheeOrg · reported by GitHubMedium 5.3
Lychee is a free, open-source photo-management tool. The patch introduced for GHSA-cpgw-wgf3-xc6v (SSRF via `Photo::fromUrl`) contains an incomplete IP validation check that fails to block loopback addresses and link-local addresses. Prior to version 7.5.1, an authenticated user can still reach internal services using direct IP addresses, bypassing all four protection configuration settings even when they are set to their secure defaults. Version 7.5.1 contains a fix for the issue.
- Product
- Lychee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026Lychee is a free, open-source photo-management tool.CVE-2026-22784 · Other software · LycheeOrg · reported by GitHubLow 2.3
Lychee is a free, open-source photo-management tool. Prior to 7.1.0, an authorization vulnerability exists in Lychee's album password unlock functionality that allows users to gain possibly unauthorized access to other users' password-protected albums. When a user unlocks a password-protected public album, the system automatically unlocks ALL other public albums that share the same password, resulting in a complete authorization bypass. This vulnerability is fixed in 7.1.0.
- Product
- Lychee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2025lychee link checking action checks links in Markdown, HTML, and text files using lychee.CVE-2024-48908 · Other software · lycheeverse · reported by GitHubMedium 6.9
lychee link checking action checks links in Markdown, HTML, and text files using lychee. Prior to version 2.0.2, there is a potential attack of arbitrary code injection vulnerability in lychee-setup of the composite action at action.yml. This issue has been patched in version 2.0.2.
- Product
- lychee-action
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2025Lychee is a free, open-source photo-management tool.CVE-2025-53018 · Other software · LycheeOrg · reported by GitHubLow 3
Lychee is a free, open-source photo-management tool. Prior to version 6.6.13, a critical Server-Side Request Forgery (SSRF) vulnerability exists in the `/api/v2/Photo::fromUrl` endpoint. This flaw lets an attacker instruct the application’s backend to make HTTP requests to any URL they choose. Consequently, internal network resources—such as localhost services or cloud-provider metadata endpoints—become reachable. The endpoint takes a URL from the user and calls it server-side via fopen() without any safeguards. There is no IP address validation, nor are there any allow-list, timeout, or size restrictions. Because of this, attackers can point the application at internal targets. Using this flaw, an attacker can perform internal port scans or retrieve sensitive cloud metadata. Version 6.6.13 contains a patch for the issue.
- Product
- Lychee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2025Lychee is a free photo-management tool.CVE-2025-50202 · Other software · LycheeOrg · reported by GitHubHigh 7.5
Lychee is a free photo-management tool. In versions starting from 6.6.6 to before 6.6.10, an attacker can leak local files including environment variables, nginx logs, other user's uploaded images, and configuration secrets due to a path traversal exploit in SecurePathController.php. This issue has been patched in version 6.6.10.
- Product
- Lychee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2024Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create new album function.CVE-2024-25808 · Other software · lycheeorg · reported by MITREHigh 8.3
Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create new album function.
- Product
- lychee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title paramCVE-2024-25807 · Other software · lycheeorg · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title parameter when creating an album.
- Product
- lychee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2023Lychee is a free photo-management tool.CVE-2023-52082 · Other software · LycheeOrg · reported by GitHubHigh 8.8
Lychee is a free photo-management tool. Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the `.env` settings set to DB_LOG_SQL=true and DB_LOG_SQL_EXPLAIN=true. The defaults settings of Lychee are safe. The patch is provided on version 5.0.2. To work around this issue, disable SQL EXPLAIN logging.
- Product
- Lychee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in php/Access/Guest.php.CVE-2021-43675 · Other software · Lycheeorg · reported by MITREMedium 6.1
Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in php/Access/Guest.php. The function exit will terminate the script and print the message to the user. The message will contain albumID which is controlled by the user.
- Product
- Lychee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.