CVE-2025-50202

HIGH

Lychee 6.6.6-6.6.9 - Path Traversal in SecurePathController

Title source: llm

Description

Lychee is a free photo-management tool. In versions starting from 6.6.6 to before 6.6.10, an attacker can leak local files including environment variables, nginx logs, other user's uploaded images, and configuration secrets due to a path traversal exploit in SecurePathController.php. This issue has been patched in version 6.6.10.

References (3)

Core 3

Core References

Vendor Advisory x_refsource_confirm

https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-6rj9-gm78-vhf9

Patch x_refsource_misc

https://github.com/LycheeOrg/Lychee/commit/ae7270b7b47e4a284ea1f69d260e52d592711072

View Patch ZIP pw:eip

Various Sources x_refsource_misc

https://github.com/LycheeOrg/Lychee/blob/0709f5d984d4df77fc5e23a29a0231437e684e99/app/Http/Controllers/SecurePathController.php#L61

View Writeup ZIP pw:eip

Scores

CVSS v3 7.5

EPSS 0.0052

EPSS Percentile 39.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-22

Status published

Products (1)

LycheeOrg/Lychee >= 6.6.6, < 6.6.10

Published Jun 18, 2025

Tracked Since Feb 18, 2026