CVE-2026-77468

In Lychee before 7.7.1, the POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array that is merged after server-computed purchase parameters. An unauthenticated buyer can replace amount, currency, returnUrl, cancelUrl, or transactionId before passing to an Omnipay gateway, allowing underpayment and acquisition of goods.

In Lychee before 7.7.0, ImageMagick PDF support with Ghostscript does not apply an effective pre-render limit to PDF page dimensions in ImagickHandler::loadPdf(). An authenticated user can upload a small PDF with an oversized /MediaBox, causing significant CPU consumption and clogging the image-processing queue.

In Lychee before 7.7.0, the hidden Omnipay Dummy test provider can be used by a buyer (including a guest) by submitting it directly, as CreateSessionRequest does not enforce OmnipayProviderType::isAllowed(). This allows completing the test gateway flow without a real payment and releasing the purchasable item if auto-fulfillment is enabled.

In Lychee before 7.6.4, SecurePathController serving GET /image/{path} concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under a specific non-default configuration, any authenticated user can read files outside the intended directory, including application configuration and other users' private images.

In Lychee before 7.6.3, the GET /api/v2/Zip endpoint authorizes album and photo archives through AlbumPolicy::canDownload() and PhotoPolicy::canDownload() without first enforcing AlbumPolicy::canAccess(). For a public, password-protected album with grants_download enabled, an unauthenticated attacker who knows the album identifier can download a ZIP archive without supplying the password.

In Lychee before 7.6.1, the POST /api/v2/Album::unlock endpoint has no throttle, attempt counter, backoff, CAPTCHA, or lockout. A remote unauthenticated attacker who knows the album identifier can automate password guesses against a password-protected album and gain access to its private photo collection.

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photos_star_visibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a photo without confirming that the caller can see it. BaseApiRequest::validateResolved() invokes SetPhotosHighlightedRequest::processValidatedValues() before authorization, and PhotoPolicy::canHighlight() returns true for anonymous callers without a canSee check. An unauthenticated attacker who can guess photo identifiers can distinguish existing private photos through differing success and not-found responses and can change their is_highlighted state, including for photos in private or password-protected albums. The issue is limited to installations using the non-default anonymous star-visibility setting. This issue is fixed in version 7.6.1.

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Actions/Import/FromUrl.php to app/Image/Files/DownloadedFile.php for a separate fopen connection. An authenticated attacker who controls DNS responses can cause validation to observe a public address and the subsequent fetch to resolve the same hostname to a private or otherwise forbidden address. This DNS rebinding time-of-check to time-of-use mismatch bypasses the intended server-side request forgery protections and can reach services available from the Lychee server, subject to deployment and TLS behavior. This issue is fixed in version 7.6.0.

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to store a javascript URI in an album or photo Markdown description because config/markdown.php enables allow_unsafe_links. PreformattedPhotoData.php and PreFormattedAlbumData.php convert the description to HTML, and gallery components render that HTML with v-html, so a visitor clicking the rendered link executes attacker-controlled JavaScript in the Lychee origin.

The lychee link checking action for Markdown, HTML, and text files prior to version 2.0.2 contains a potential arbitrary code injection vulnerability in lychee-setup of the composite action at action.yml. This issue has been patched in version 2.0.2.