CVE-2026-71805: LZ-litchi Path Traversal Vulnerability

CVE-2026-71805 Overview

CVE-2026-71805 is an arbitrary file upload and path traversal vulnerability in LZ-litchi version 1.0.0. The flaw resides in the POST /app-api/infra/file/upload endpoint, which accepts a user-controlled directory parameter without proper validation. Unauthenticated remote attackers can upload arbitrary files and write them outside the intended storage directory. This combination of missing authentication, missing file-type validation, and traversal in the destination path enables attackers to place executable content in web-accessible or sensitive locations. Successful exploitation can lead to remote code execution, application compromise, or persistent web shells.

Critical Impact
Unauthenticated attackers can write arbitrary files anywhere the application process has write access, enabling remote code execution and full application compromise.

Affected Products

LZ-litchi 1.0.0
Deployments exposing the /app-api/infra/file/upload endpoint
Applications embedding the vulnerable infra file upload module

Discovery Timeline

2026-09-09 - CVE-2026-71805 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-71805

Vulnerability Analysis

The vulnerability combines two weaknesses in the LZ-litchi file upload handler. First, the endpoint POST /app-api/infra/file/upload does not enforce authentication, so any remote client can invoke it. Second, the handler accepts a directory parameter from the request and uses it to construct the destination path without normalizing or restricting traversal sequences.

An attacker can supply values such as ../../ in the directory parameter to escape the intended storage root. The handler also does not restrict the uploaded file's extension or MIME type, so binary, script, and template files can be written directly to disk. When the destination overlaps with a web-served directory or an application classpath, uploaded content becomes executable.

The combined weaknesses map to [CWE-434] (Unrestricted Upload of File with Dangerous Type) and [CWE-22] (Path Traversal). See the GitHub Issue Discussion for reproduction details.

Root Cause

The root cause is missing server-side validation on two inputs: the caller's identity and the directory parameter. The upload service trusts client-supplied path segments and file names, then concatenates them to the base storage path. No canonicalization step confirms the resolved path remains within an allowlisted directory, and no policy restricts uploaded extensions.

Attack Vector

The attack requires only network reachability to the application's HTTP interface. An attacker sends a multipart POST request to /app-api/infra/file/upload with a crafted directory value containing traversal sequences and an uploaded file such as a JSP, PHP, or JAR payload. The server writes the file at the resolved path. The attacker then requests the written file through the web server or triggers it via an application code path to gain execution.

No verified proof-of-concept code has been published. The vulnerability behavior is described in the GitHub Issue Discussion.

Detection Methods for CVE-2026-71805

Indicators of Compromise

HTTP POST requests to /app-api/infra/file/upload from unauthenticated sources or unusual IP ranges
Request bodies containing a directory parameter with ../, ..\, URL-encoded %2e%2e%2f, or absolute path values
New files with executable extensions (.jsp, .jspx, .war, .php, .sh) appearing outside the designated upload directory
Web server access logs showing requests to newly created files immediately after an upload event

Detection Strategies

Inspect reverse proxy and application logs for calls to the upload endpoint that omit session cookies or authentication headers
Alert when the directory request parameter contains traversal metacharacters or non-allowlisted paths
Monitor the application's storage root and adjacent directories for file creation events performed by the application service account

Monitoring Recommendations

Enable file integrity monitoring on web-served directories, WEB-INF, and application binary paths
Forward web server, WAF, and endpoint telemetry to a centralized data lake for correlation of upload requests with subsequent file execution
Baseline normal upload volume and destination paths, and alert on deviations such as uploads to system directories

How to Mitigate CVE-2026-71805

Immediate Actions Required

Restrict network access to /app-api/infra/file/upload using a reverse proxy or WAF rule until a patched build is deployed
Require authentication and authorization on all infra file upload routes
Audit the application storage root and web directories for unexpected files written since exposure of the endpoint

Patch Information

No vendor patch has been listed in the CVE record at publication time. Track the GitHub Issue Discussion for maintainer updates and apply upstream fixes as they are released.

Workarounds

Reject any request where the directory parameter contains .., absolute paths, or non-allowlisted values, and canonicalize the resolved path before writing
Enforce an allowlist of file extensions and validate MIME types on the server side
Store uploads on a separate volume that is mounted noexec and is not served directly by the web server
Run the application under a low-privilege account with write access only to the intended upload directory

bash

# Example reverse proxy block for the vulnerable endpoint
location = /app-api/infra/file/upload {
    # Deny requests where 'directory' contains traversal sequences
    if ($arg_directory ~* "(\.\./|\.\.\\|%2e%2e)") {
        return 403;
    }
    # Require an authenticated session cookie
    if ($http_cookie !~* "SESSION=") {
        return 401;
    }
    proxy_pass http://app_backend;
}