CVE-2026-77467 Details
Description
Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee enables ImageMagick PDF support with Ghostscript but does not apply an effective pre-render limit to PDF page dimensions in ImagickHandler::loadPdf(). An authenticated user who can upload a small PDF with an oversized /MediaBox can cause Imagick::readImage() to consume substantial CPU before failing to produce an image. When QUEUE_CONNECTION selects synchronous processing the request can occupy a web worker, while the official asynchronous Docker configuration can clog the shared image-processing queue and delay other work. The advisory did not identify a Ghostscript sandbox escape. This issue is fixed in version 7.7.0.
A denial-of-service vulnerability has been identified in Lychee versions prior to 7.7.0. The issue arises in the ImageMagick PDF handling within the ImagickHandler class. When an authenticated user uploads a small PDF file with an oversized MediaBox, the Imagick::readImage() function can be manipulated to consume excessive CPU resources. This problem is exacerbated when QUEUE_CONNECTION is set to synchronous processing, as it can block a web worker for an extended period. Even in the official asynchronous Docker configuration, the shared image-processing queue can be disrupted, causing delays for other tasks.
Users can update to Lychee version 7.7.0 or later, where this vulnerability has been fixed. In addition, it's recommended to set explicit resource limits in ImageMagick's policy.xml file and to add a pre-processing check for PDF MediaBox dimensions before the files are handled by Imagick.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-6736-fhxv-3p79 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/LycheeOrg/Lychee/commit/1e92846af4c2d259a225cf4517de17efba04f945 | [email protected] | Source CodeVendor |
| https://github.com/LycheeOrg/Lychee/pull/4511 | [email protected] | Issue TrackingVendor |
| https://github.com/LycheeOrg/Lychee/releases/tag/v7.7.0 | [email protected] | Release NotesVendor |
| https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-6736-fhxv-3p79 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Lychee | <= 7.6.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |