Product by LycheeOrg

    Lychee

    21 known vulnerabilities in Lychee (LycheeOrg), 0 of them actively exploited (CISA KEV).

    Key figures

    21

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    1

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Lychee (LycheeOrg)
    HighCVE-2026-77470

    Lychee: External Control of Assumed-Immutable Web Parameter

    		—
    HighCVE-2026-77466

    Lychee: Webshop payment bypass via unrestricted "Dummy" gateway selection

    		—
    HighCVE-2026-61838

    Lychee: Album password bypass in ZIP downloads

    		—
    HighCVE-2026-62679

    Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read

    		—
    HighCVE-2026-61611

    Lychee: Missing rate limiting on album password unlock endpoint allows brute-force attacks

    		7.5
    MediumCVE-2026-77468

    Lychee: Allocation of Resources Without Limits or Throttling

    		—
    HighCVE-2026-77467

    Lychee: A single 383-byte PDF causes ~184 seconds of CPU consumption in the real processing path

    		—
    HighCVE-2025-50202

    Lychee Path Traversal Vulnerability

    		7.5
    MediumCVE-2026-57568

    Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View)

    		—
    CriticalCVE-2023-52082

    Lychee: SQL Injection

    		8.8
    MediumCVE-2021-43675

    Lychee: Cross-Site Scripting (XSS)

    		6.1
    HighCVE-2024-25808

    Lychee: Cross-Site Request Forgery (CSRF)

    		8.3
    MediumCVE-2024-25807

    Lychee: Cross-Site Scripting (XSS)

    		6.1
    LowCVE-2026-61610

    Lychee: Improper Access Control

    		—
    MediumCVE-2026-33537

    Lychee: Server-Side Request Forgery (SSRF)

    		5.0
    MediumCVE-2026-33738

    Lychee: Cross-site Scripting

    		5.4
    LowCVE-2026-57569

    Lychee: Time-of-check Time-of-use (TOCTOU) Race Condition

    		—
    MediumCVE-2026-33644

    Lychee: Server-Side Request Forgery (SSRF)

    		4.3
    MediumCVE-2026-39957

    Lychee: Incorrect Authorization

    		4.3
    MediumCVE-2026-22784

    Lychee cross-album password propagation on Album unlocking

    		4.3
    LowCVE-2025-53018

    Lychee: Server-Side Request Forgery (SSRF)

    		3.0

    All products by LycheeOrg