An authenticated user can upload a small PDF with an oversized /MediaBox to cause substantial CPU consumption before failing to produce an image, affecting Lychee photo-management tool versions before 7.7.0. This issue can occupy a web worker in synchronous processing and clog the shared image-processing queue in asynchronous Docker configurations, leading to delays. Defenders should assess exposure and p [truncated]
An unauthenticated attacker can exploit this vulnerability in Lychee photo-management tool version prior to 7.6.1 when the non-default anonymous star-visibility setting is used, allowing them to distinguish existing private photos and change their highlighted state. This issue enables attackers to infer the existence of private photos through subtle differences in response times or error messages, potenti [truncated]
