CVE-2026-62679

Deferred Deferred - Pending Action

Path Traversal in Lychee Photo Management Tool

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/{path}, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under the supported non-default configuration with temporary_image_link_enabled enabled, temporary_image_link_when_logged_in disabled, and secure_image_link_enabled disabled, any authenticated user can submit encoded traversal segments that pass the prefix check and are later resolved by filesystem operations. This permits reading files available to the web process, including application configuration and other users' private images, and disclosed APP_KEY or database credentials can enable further compromise. This issue is fixed in version 7.6.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-62679

EUVD

EUVD-2026-102192

Affected Vendors & Products

Vendor	Product	Version / Range
LycheeOrg	Lychee	< 7.6.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-62679 is a path traversal vulnerability in Lychee, a photo-management tool. It allows authenticated users to read arbitrary files on the server by exploiting improper path validation in the SecurePathController component. The issue occurs when user-controlled input is concatenated to build a filesystem path, and a prefix check is performed before canonicalizing the path. This permits bypassing the check with encoded traversal sequences like %2e%2f or backslashes, enabling access to sensitive files such as application configuration, database credentials, or other users' private images.

Detection Guidance

Check Lychee version with: docker exec <container> php -v | grep Lychee. If version is <=7.6.3, the system is vulnerable. Inspect web server logs for requests to /image/{path} with encoded traversal sequences like %2e%2f or %2e%2e%2f. Use curl to test paths: curl -u user:pass http://server/image/../../../../etc/passwd. If responses return file contents, the vulnerability is present.

Enable debug mode in Lychee config to log path resolution attempts. Monitor for HTTP 418 errors in SecureImageLinksTest.php which indicate blocked traversal attempts. Scan for unauthorized access to .env or other sensitive files in application directories.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive files, including application secrets like APP_KEY or database credentials. Attackers may read private images of other users, escalate privileges, or forge signed URLs. Exploiting this requires only basic authentication and specific non-default configurations, making it a high-impact issue for affected systems.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive files, including application configuration files containing secrets like APP_KEY or database credentials. If exploited, it may result in data breaches that violate GDPR's data protection requirements or HIPAA's safeguards for protected health information, depending on the data stored.

Mitigation Strategies

Upgrade Lychee to version 7.6.4 or later immediately. Disable temporary_image_link_enabled in config if not required. Rotate APP_KEY and database credentials if they may have been exposed. Review and restrict file permissions for the web process user.

Apply the SecurePathController patch from commit f4553f6 if upgrading is not immediately possible. Enable secure_image_link_enabled and temporary_image_link_when_logged_in to default settings. Monitor for unusual file access patterns in logs.

Hi! I’m here to help you understand CVE-2026-62679. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70