CVE-2026-71805: Path Traversal
An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. Unauthenticated remote attackers can upload arbitrary files and write them outside the intended storage directory via the directory parameter in POST /app-api/infra/file/upload.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Unauthenticated remote attackers can exploit it, so exposure depends on whether the affected upload endpoint is reachable over the network.
What request component is used to escape the intended upload directory?
The path traversal is performed through the directory parameter in POST /app-api/infra/file/upload. An attacker can use it to write uploaded files outside the intended storage directory.
What can be done if updating is not immediately possible?
The provided data does not identify a fix or workaround. Restricting unauthenticated network access to the affected upload endpoint would reduce exposure, but this is not stated as a vendor-provided mitigation.