Vulnerabilities > CVE-2023-52082 - Unspecified vulnerability in Lycheeorg Lychee

047910
CVSS 9.8 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
lycheeorg
critical
NVD
Published: 2023-12-28
Updated: 2024-11-21

Summary

Lychee is a free photo-management tool. Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the `.env` settings set to DB_LOG_SQL=true and DB_LOG_SQL_EXPLAIN=true. The defaults settings of Lychee are safe. The patch is provided on version 5.0.2. To work around this issue, disable SQL EXPLAIN logging.

Vulnerable Configurations

Part Description Count
Application
Lycheeorg
1

References