CVE-2026-62679: Lychee Photo Management Path Traversal Flaw

CVE-2026-62679 Overview

CVE-2026-62679 is a path traversal vulnerability [CWE-22] in Lychee, a free, open-source photo-management application. The flaw resides in SecurePathController, which serves the GET /image/{path} endpoint. The controller concatenates attacker-controlled input with the local storage root and performs a string-prefix check before canonicalizing dot segments. Authenticated users can submit encoded traversal sequences that bypass the prefix check and are later resolved by filesystem operations. Successful exploitation discloses files readable by the web process, including application configuration, other users' private images, the APP_KEY, and database credentials. The issue is fixed in Lychee version 7.6.4.

Critical Impact
Authenticated attackers can read arbitrary files accessible to the web process, including Laravel APP_KEY and database credentials, enabling further compromise of the application and stored data.

Affected Products

Lychee photo-management tool prior to version 7.6.4
Deployments with temporary_image_link_enabled set to true
Deployments with temporary_image_link_when_logged_in disabled and secure_image_link_enabled disabled

Discovery Timeline

2026-10-15 - CVE-2026-62679 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-62679

Vulnerability Analysis

The vulnerability resides in app/Http/Controllers/SecurePathController.php, the Lychee component responsible for serving image files through the GET /image/{path} route. The controller joins the user-supplied path parameter to the configured storage root and validates the result using a string-prefix comparison. Only after this comparison does downstream code canonicalize dot segments through filesystem calls. The ordering means an input such as URL-encoded ..%2f sequences passes the prefix check while still resolving outside the intended directory. Attackers must authenticate to reach the route, but no additional privileges are required. The impact extends beyond images because the web process typically has read access to the Laravel application directory, including .env secrets and other users' private media.

Root Cause

The root cause is validation-before-canonicalization. SecurePathController trusted the lexical structure of the joined path rather than its resolved filesystem form. The fix in commit f4553f6 imports Safe\realpath and FilesystemException to resolve paths before authorization checks, ensuring traversal segments are collapsed prior to comparison with the storage root.

Attack Vector

Exploitation requires an authenticated session and a non-default configuration in which temporary_image_link_enabled is true, temporary_image_link_when_logged_in is false, and secure_image_link_enabled is false. The attacker issues a GET /image/{path} request with encoded traversal segments in the {path} component. The server returns the raw contents of any file accessible to the PHP-FPM or web server process.

php

 use Illuminate\Support\Facades\Crypt;
 use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Facades\Storage;
+use Safe\Exceptions\FilesystemException;
+use function Safe\realpath;
 
 /**
  * Controller responsible for serving files securely.

Source: GitHub Commit f4553f6 — the patch introduces Safe\realpath so paths are canonicalized before the prefix check.

Detection Methods for CVE-2026-62679

Indicators of Compromise

Web server access logs containing GET /image/ requests with encoded traversal patterns such as ..%2f, %2e%2e%2f, or %252e%252e%252f in the path component.
Requests to /image/ returning content types inconsistent with image data, such as text/plain or configuration file contents.
Access patterns targeting Laravel application files, especially requests resolving to .env, config/*.php, or storage directories owned by other users.

Detection Strategies

Review web application logs for sequences of GET /image/{path} requests from a single authenticated session traversing above the storage root.
Correlate successful 200 responses on /image/ endpoints with abnormally small or non-image payload sizes.
Deploy a Web Application Firewall rule to flag or block URL-decoded traversal segments on the /image/ route.

Monitoring Recommendations

Monitor filesystem access by the PHP-FPM or Apache user for reads outside the Lychee media directory.
Alert on reads of .env, database.php, or any file containing APP_KEY or database credentials by the web process.
Track authentication events preceding bursts of /image/ requests to identify compromised or probing accounts.

How to Mitigate CVE-2026-62679

Immediate Actions Required

Upgrade Lychee to version 7.6.4, which applies the realpath canonicalization fix in SecurePathController.
Rotate the Laravel APP_KEY and all database credentials if the vulnerable configuration was active in production.
Audit user accounts and revoke sessions for any user showing anomalous /image/ request patterns.

Patch Information

The fix is published in GitHub Release v7.6.4 through GitHub Pull Request #4465 and commit f4553f6. Full details are documented in GitHub Security Advisory GHSA-j5ff-34x8-xxqg.

Workarounds

Disable temporary_image_link_enabled to prevent the vulnerable code path from being reachable.
Enable secure_image_link_enabled to enforce the canonicalized access control path.
Restrict filesystem permissions so the web process cannot read .env or other configuration files containing secrets.

bash

# Configuration example - disable the vulnerable code path in Lychee .env
TEMPORARY_IMAGE_LINK_ENABLED=false
SECURE_IMAGE_LINK_ENABLED=true