Is CVE-2026-62679 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62679 being exploited in the wild.

How severe is CVE-2026-62679?

Informational severity, published 15 October 2026.

How is CVE-2026-62679 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-62679?

Check whether you run LycheeOrg Lychee at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62679: Lychee path traversal in SecurePathController image serving

CVE-2026-62679 · Severity: info · Published 2026-10-15

Lychee is an open-source photo management application that stores and serves user images. Under specific non-default configuration settings, authenticated users can bypass path validation to read arbitrary files from the server, including application configuration files, database credentials, and other users' private photos. An attacker who obtains exposed credentials can escalate their access further.

Technologies: LycheeOrg Lychee. Vendors: LycheeOrg.

Quick answers

Is CVE-2026-62679 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62679 being exploited in the wild.
How severe is CVE-2026-62679?: Informational severity, published 15 October 2026.
Which products and versions are affected?: LycheeOrg Lychee before 7.6.4.
Is there a fix for CVE-2026-62679?: Yes: fixed in 7.6.4. Until then: Ensure the non-default configuration values temporary_image_link_enabled, temporary_image_link_when_logged_in, and secure_image_link_enabled are not set in a way that enables this path-traversal condition, or upgrade to version 7.6.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62679 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-62679?: Check whether you run LycheeOrg Lychee at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 7.6.4

Ensure the non-default configuration values temporary_image_link_enabled, temporary_image_link_when_logged_in, and secure_image_link_enabled are not set in a way that enables this path-traversal condition, or upgrade to version 7.6.4 or later.

Technical details

The SecurePathController endpoint GET /image/{path} performs a string-prefix validation check before canonicalizing dot segments, allowing an authenticated user to submit URL-encoded traversal sequences (such as ../) that pass the prefix check but are later resolved by filesystem operations. The vulnerability is only exploitable under a specific non-default configuration where temporary_image_link_enabled is true, temporary_image_link_when_logged_in is false, and secure_image_link_enabled is false. This permits reading any file accessible to the web process.

Affected products

LycheeOrg Lychee before 7.6.4

Timeline

2026-10-15: disclosed
2026-06-26: patched: Fix merged in GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.