CVE-2026-71805 Details

A vulnerability allowing arbitrary file upload and path traversal has been identified in LZ-Litchi version 1.0.0. This issue arises from the app-side file upload endpoint, which is accessible without authentication. Unauthenticated remote attackers can exploit this vulnerability by uploading files and writing them outside the designated storage directory. The vulnerability is caused by the lack of validation on user-controlled directory and filename parameters, allowing attackers to manipulate file paths and access uploaded files through an admin-side download endpoint.

To address this vulnerability, remove the '@PermitAll' annotation from the upload endpoint and implement proper authentication. Additionally, normalize and restrict the 'directory' and 'path' parameters to prevent path traversal. Enforce a server-side whitelist for file types and filenames, and harden the admin-side download endpoint to include authentication and proper path validation.