CVE-2025-50202: 
Wolfi vulnerability analysis and mitigation

CVE-2025-50202 is a path traversal vulnerability in Lychee, a free open-source photo-management tool, affecting versions 6.6.6 through 6.6.9. The flaw resides in SecurePathController.php, which fails to validate or restrict path traversal sequences in user-supplied input, allowing authenticated low-privileged users to read arbitrary files on the server. It was disclosed on June 17–18, 2025, and patched in version 6.6.10. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, ENISA EUVD).

The root cause is classified as CWE-22 (Path Traversal) and CWE-73 (External Control of File Name or Path). In the vulnerable SecurePathController.php, the __invoke method resolves a user-supplied $path parameter directly via Storage::disk(...)->path($path) and then serves the resulting file without verifying that the resolved path remains within the intended storage directory (GitHub Source). An attacker can supply URL-encoded path traversal sequences (e.g., ..%2f) in the image path parameter to escape the storage root and access arbitrary files. The fix adds an explicit check that the resolved file path starts with the expected storage root, throwing a PathTraversalException if it does not (GitHub Commit).

Successful exploitation allows a low-privileged authenticated attacker to read arbitrary files from the server's filesystem, including sensitive configuration files such as .env (containing application secrets, database credentials, and API keys), nginx access logs (which may expose other users' request history and image URLs), and other users' private uploaded images (GitHub Advisory). The confidentiality impact is rated High, with no integrity or availability impact. Leaked credentials from .env files could enable further lateral movement or full application compromise.

A proof-of-concept is implicitly described in the security advisory: any low-privileged user can issue simple HTTP GET requests such as GET /image/..%2fconf%2f.env to retrieve sensitive files (GitHub Advisory). No evidence of in-the-wild exploitation or threat actor attribution has been reported. The EPSS score is approximately 0.041% (very low), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack requires a valid (low-privileged) user account, which limits opportunistic mass exploitation but makes it a significant insider or post-authentication threat.

1. Obtain a low-privileged account: Register or obtain credentials for any user account on the target Lychee instance running versions 6.6.6–6.6.9.
2. Authenticate: Log in to the Lychee application to obtain a valid session or authentication token.
3. Identify the image serving endpoint: The vulnerable endpoint is the /image/ route handled by SecurePathController.php.
4. Craft a path traversal request: Construct a GET request using URL-encoded traversal sequences to escape the storage directory, e.g.:
   • GET /image/..%2fconf%2f.env — to retrieve the application's environment file
   • GET /image/..%2fvar%2fwww%2fhtml%2fLychee%2f.env — alternate path to the .env file
   • GET /image/..%2fvar%2flog%2fnginx%2faccess.log — to retrieve nginx access logs
5. Exfiltrate sensitive data: Parse the returned file contents for database credentials, application secrets, API keys, or other users' image paths from nginx logs.
6. Leverage leaked credentials: Use extracted secrets for further access to databases, cloud services, or other integrated systems (GitHub Advisory).

• Network: Unusual HTTP GET requests to the /image/ endpoint containing URL-encoded traversal sequences such as ..%2f, %2e%2e%2f, or ..%252f in the path parameter; requests targeting non-image file paths (e.g., .env, access.log, config.php).
• Logs: Web server (nginx/Apache) access logs showing requests to /image/ with path components resolving outside the storage directory; Lychee application logs containing Invalid path for secure path request entries (present only after patching — absence of this log in older versions is expected).
• File System: No direct file system artifacts from read-only exploitation; however, if credentials are subsequently used, look for unauthorized database access or new admin accounts.
• Process: No unusual process spawning expected, as this is a file read vulnerability with no code execution component (GitHub Advisory).

Upgrade Lychee to version 6.6.10 or later, which includes the patch commit ae7270b that adds path boundary validation in SecurePathController.php (GitHub Advisory). No official configuration-based workaround is provided; the only remediation is upgrading. As an interim measure, administrators may consider restricting access to the Lychee instance to trusted users only, or placing the application behind a WAF with rules to block URL-encoded path traversal sequences in request paths.

The vulnerability was reported by security researcher MrRauL124 and remediated by Lychee maintainer ildyria, who published the GitHub Security Advisory on June 17, 2025 (GitHub Advisory). The issue was picked up by standard vulnerability tracking services including ENISA EUVD, INCIBE-CERT, and Red Hat's CVE database shortly after disclosure. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified.