CVE-2026-62679 LycheeOrg CVE debrief

Who should care

Users of Lychee versions before 7.6.4, administrators of Lychee installations, security teams responsible for monitoring and patching vulnerabilities, and operators managing affected systems should be aware of this vulnerability and take immediate action to protect their environments.

Why it matters

Authenticated users of Lychee photo-management tool versions before 7.6.4 may be able to read arbitrary files due to a path traversal vulnerability in SecurePathController, which can lead to sensitive information disclosure and potential further compromise.

• Authenticated users may be able to read sensitive files, including application configuration and private images.
• Disclosed APP_KEY or database credentials may enable further compromise.
• Verify and apply patches for Lychee versions before 7.6.4 to prevent exploitation.
• Monitor for suspicious activity to detect potential exploitation attempts.

Technical summary

The path traversal vulnerability in Lychee's SecurePathController allows authenticated users to read arbitrary files by submitting encoded traversal segments that pass the prefix check and are later resolved by filesystem operations. This issue is particularly severe under the supported non-default configuration with temporary_image_link_enabled enabled, temporary_image_link_when_logged_in disabled, and secure_image_link_enabled disabled. The vulnerability can lead to sensitive information disclosure, including application configuration and private images, and disclosed APP_KEY or database credentials may enable further compromise.

Defensive priority

High priority for users of Lychee versions before 7.6.4; verify and apply patches immediately.

Recommended defensive actions

• Verify and apply patches for Lychee versions before 7.6.4
• Restrict access to sensitive files and configurations
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the path traversal vulnerability in Lychee's SecurePathController, which allows authenticated users to read arbitrary files. The issue is fixed in version 7.6.4.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.