CVE-2026-62679: Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read
Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/{path}, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under the supported non-default configuration with temporaryimagelinkenabled enabled, temporaryimagelinkwhenloggedin disabled, and secureimagelinkenabled disabled, any authenticated user can submit encoded traversal segments that pass the prefix check and are later resolved by filesystem operations. This permits reading files available to the web process, including application configuration and other users' private images, and disclosed APPKEY or database credentials can enable further compromise. This issue is fixed in version 7.6.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Lycheeto a version that resolves this vulnerability.Fixed in 7.6.4
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running a version prior to 7.6.4 are exposed only under the supported non-default configuration where temporary_image_link_enabled is enabled, temporary_image_link_when_logged_in is disabled, and secure_image_link_enabled is disabled.
What access does an attacker need?
An attacker must be authenticated. They can submit encoded traversal segments through the GET /image/{path} endpoint to read files accessible to the web process.
What files could be exposed and why does this matter?
Accessible files can include application configuration and other users' private images. Exposure of APP_KEY or database credentials may enable further compromise.
What should be done if patching cannot happen immediately?
Disable the affected configuration by turning off temporary_image_link_enabled, or avoid the combination in which temporary_image_link_when_logged_in and secure_image_link_enabled are disabled. Upgrade to 7.6.4 when possible.