CVE-2026-62679

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-62679
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62679.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-62679
Aliases
  • GHSA-j5ff-34x8-xxqg
Published
2026-10-15T16:33:43Z
Modified
2026-10-16T02:47:59Z
Severity
  • 8.9 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H CVSS Calculator
Summary
Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read
Details

Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/{path}, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under the supported non-default configuration with temporary_image_link_enabled enabled, temporary_image_link_when_logged_in disabled, and secure_image_link_enabled disabled, any authenticated user can submit encoded traversal segments that pass the prefix check and are later resolved by filesystem operations. This permits reading files available to the web process, including application configuration and other users' private images, and disclosed APP_KEY or database credentials can enable further compromise. This issue is fixed in version 7.6.4.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62679.json"
}
References

Affected packages

Git / github.com/lycheeorg/lychee

Affected ranges

Type
GIT
Repo
https://github.com/lycheeorg/lychee
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f4553f6e0145ec4e02360c6121bd169e87b5d05f
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "7.6.4"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v4.*
v4.0.0
v4.0.0-alpha.1
v4.0.0-beta.1
v4.0.0-beta.2
v4.0.1
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.1.0
v4.10.0
v4.11.0
v4.11.1
v4.12.0
v4.13.0
v4.2.0
v4.2.1
v4.2.2
v4.3.0
v4.3.4
v4.3.5
v4.3.6
v4.4.0
v4.5.0
v4.5.1
v4.5.2
v4.5.3
v4.6.0
v4.6.0-RC
v4.6.0-RC2
v4.6.0-RC3
v4.6.1
v4.6.1-RC1
v4.6.1-RC2
v4.6.2
v4.6.2-RC1
v4.6.2-RC2
v4.6.3-RC1
v4.6.4
v4.6.5
v4.7.0
v4.7.1
v4.7.2
v4.7.3
v4.7.4
v4.8.0
v4.8.1
v4.9.0
v4.9.1
v4.9.2
v4.9.3
v4.9.3-RC
v4.9.4
v5.*
v5.0.0
v5.0.0-beta
v5.0.1
v5.0.2
v5.0.3
v5.1.0
v5.1.1
v5.1.2
v5.2.0
v5.2.1
v5.2.2
v5.3.0
v5.3.1
v5.4.0
v5.5.0
v5.5.1
v6.*
v6.0.0
v6.0.1
v6.1.0
v6.1.1
v6.1.2
v6.10.0
v6.10.1
v6.10.2
v6.10.3
v6.10.4
v6.2.0
v6.3.0
v6.3.1
v6.3.2
v6.3.3
v6.3.4
v6.3.5
v6.4.0
v6.4.1
v6.4.2
v6.5.0
v6.5.1
v6.5.2
v6.5.3
v6.6.0
v6.6.1
v6.6.10
v6.6.11
v6.6.12
v6.6.13
v6.6.14
v6.6.2
v6.6.3
v6.6.4
v6.6.5
v6.6.6
v6.6.7
v6.6.8
v6.6.9
v6.7.0
v6.7.1
v6.7.2
v6.8.0
v6.8.1
v6.9.0
v6.9.1
v6.9.2
v6.9.3
v6.9.4
v7.*
v7.0.0
v7.0.1
v7.1.0
v7.1.1
v7.1.2
v7.2.0
v7.2.1
v7.3.0
v7.3.1
v7.3.2
v7.3.3
v7.4.0
v7.4.1
v7.4.2
v7.5.0
v7.5.1
v7.5.2
v7.5.3
v7.5.4
v7.6.0
v7.6.1
v7.6.2
v7.6.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62679.json"