CVE ID :CVE-2026-62679 Published : Oct. 15, 2026, 5:17 p.m. | 16 minutes ago Description :Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/{path}, concatenates the attacker-controlled path with the local storage root and...

#Sicherheitslücke

Original-Artikel öffnen Zurück zur Übersicht

ARTICLEVIEW

CVE-2026-62679 - Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read

VERWANDTEARTIKEL

CVE-2026-85634 - Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in deployment name

CVE-2026-77466 - Lychee: Webshop payment bypass via unrestricted "Dummy" gateway selection

CVE-2026-77470 - Lychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST request

CVE-2026-61838 - Lychee: Album password bypass in ZIP downloads

CVE-2026-110812 - Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune

CVE-2026-83905