Lychee, a popular open‑source photo‑management application, has a path traversal flaw in SecurePathController. The controller concatenates a user‑controlled path segment with the storage root and only performs a string‑prefix check before normalizing the path. For users who enable temporary_image_link_enabled and satisfy certain configuration toggles, crafted traversal sequences can bypass the check, allowing the web process to read any file within its filesystem. An attacker with normal application credentials can read configuration files, database credentials, and other users’ private images, and the disclosed APP_KEY could be leveraged for further compromise. The vulnerability provides a means to obtain sensitive configuration information but does not directly lead to code execution.

All installations of Lychee running version 7.6.4 or earlier are susceptible when the temporary_image_link feature is enabled and secure_image_link is disabled. The flaw resides in the SecurePathController that serves GET /image/{path}. The issue manifests under the non‑default configuration where temporary_image_link_enabled is true, temporary_image_link_when_logged_in is false, and secure_image_link_enabled is false. No specific minor version is listed beyond the 7.6.4 boundary, so any 7.x release prior to 7.6.4 with those settings is affected.

The CVSS score of 8.9 indicates high severity. The EPSS score of less than 1% suggests that exploitation likelihood is very low at present, and the vulnerability is not cataloged in the CISA KEV list. The attack requires an authenticated user and a specific feature configuration, but once those conditions are met, the attacker can retrieve arbitrary files accessible to the web process. Given that APP_KEY or database credentials can be retrieved, this flaw could be a stepping stone for a broader compromise. The exploitation path is straightforward: send a crafted GET request to /image/<traversal‑encoded‑path>. The vulnerability is only visible within the application’s own configuration and filesystem, meaning the impact is confined to the host where Lychee is running.