CVE-2026-62679: Lychee < 7.6.4

Affected technology

Lychee · < 7.6.4
LycheeOrg

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

The source says under the supported non-default configuration with temporary_image_link_enabled enabled, temporary_image_link_when_logged_in disabled, and secure_image_link_enabled disabled, any authenticated user can submit encoded traversal segments that pass the prefix check and are later resolved by filesystem operations. Vendor/CNA’s CVSS 4.0 assessment (base score 8.9/10) rates confidentiality and integrity impact as high; availability impact as none.