Path Traversal Vulnerability in Lychee Photo Management Tool

CVE-2026-62679

What is CVE-2026-62679?

Lychee, the open-source photo management tool, is vulnerable to a path traversal issue where an authenticated user can manipulate image paths. This vulnerability allows an attacker to read unauthorized files from the server, including application configurations and private user images. Without proper security settings in place, encoded traversal segments can bypass access controls, potentially compromising sensitive information such as the APP_KEY or database credentials. Users are urged to upgrade to version 7.6.4 to ensure protection against this security flaw.

References