CVE-2025-50202: Lychee Path Traversal Vulnerability
Lychee is a free photo-management tool. In versions starting from 6.6.6 to before 6.6.10, an attacker can leak local files including environment variables, nginx logs, other user's uploaded images, and configuration secrets due to a path traversal exploit in SecurePathController.php. This issue has been patched in version 6.6.10.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-50202?
CVE-2025-50202 is considered to be of medium severity due to its path traversal vulnerability that can expose sensitive local files.
How do I fix CVE-2025-50202?
To fix CVE-2025-50202, update your Lychee installation to version 6.6.10 or later, which addresses the path traversal issue.
What versions of Lychee are affected by CVE-2025-50202?
CVE-2025-50202 affects Lychee versions starting from 6.6.6 up to, but not including, 6.6.10.
What kind of data can be leaked due to CVE-2025-50202?
CVE-2025-50202 allows attackers to leak local files including environment variables, nginx logs, and other users' uploaded images.
Is CVE-2025-50202 a zero-day exploit?
CVE-2025-50202 is not classified as a zero-day exploit, as it has been publicly disclosed and patched.