CVE-2026-71805

Deferred Deferred - Pending Action

Arbitrary File Upload and Path Traversal in LZ-litchi 1.0.0

Publication date: 2026-09-09

Last updated on: 2026-09-10

Assigner: MITRE

Description

An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. Unauthenticated remote attackers can upload arbitrary files and write them outside the intended storage directory via the directory parameter in POST /app-api/infra/file/upload.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-10

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-71805

EUVD

EUVD-2026-75209

Affected Vendors & Products

Vendor	Product	Version / Range
lz-litchi	lz-litchi	1.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability is an arbitrary file upload and path traversal issue in LZ-litchi version 1.0.0. It allows unauthenticated remote attackers to upload files to any location on the server by manipulating the directory parameter in the POST request to /app-api/infra/file/upload.

Detection Guidance

To detect this vulnerability, monitor network traffic for POST requests to /app-api/infra/file/upload with unusual directory parameters. Check server logs for unexpected file uploads outside intended directories. Use tools like Wireshark or tcpdump to inspect HTTP POST requests targeting this endpoint.

Impact Analysis

Attackers could upload malicious files like web shells, which could lead to remote code execution, data theft, or full system compromise. Sensitive files could be overwritten or accessed, disrupting services or leaking confidential information.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face legal penalties and reputational damage.

Mitigation Strategies

Immediately restrict access to the /app-api/infra/file/upload endpoint. Update or patch the LZ-litchi application to the latest version. Implement strict input validation for file uploads and directory parameters. Disable unauthenticated file uploads if possible.

Hi! I’m here to help you understand CVE-2026-71805. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70