CVE-2026-62679 Details

A path traversal vulnerability has been identified in Lychee versions prior to 7.6.4. The issue resides in the SecurePathController, which handles GET requests to /image/{path}. The vulnerability arises because the controller concatenates user-supplied paths with the local storage root, performing a prefix check before properly canonicalizing the path segments. This flaw allows authenticated users to exploit encoded traversal sequences that bypass the initial check, leading to unauthorized access to files readable by the web process. Such files may include sensitive application data, like configuration files or private images of other users. The vulnerability is particularly concerning as it can be exploited to access critical information, such as the application's APP_KEY or database credentials, potentially leading to further compromise.

Users should update to Lychee version 7.6.4 or later, and rotate the APP_KEY and database credentials. Instructions for updating can be found in the Lychee release notes.