CVE-2026-77467High· 7.1▾ TwilightLychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee enables ImageMagick PDF support with Ghostscript but does not apply an effective pre-render limit to PDF page dimensions in ImagickHandler::loadPdf(). An authent…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee enables ImageMagick PDF support with Ghostscript but does not apply an effective pre-render limit to PDF page dimensions in ImagickHandler::loadPdf(). An authenticated user who can upload a small PDF with an oversized /MediaBox can cause Imagick::readImage() to consume substantial CPU before failing to produce an image. When QUEUE_CONNECTION selects synchronous processing the request can occupy a web worker, while the official asynchronous Docker configuration can clog the shared image-processing queue and delay other work. The advisory did not identify a Ghostscript sandbox escape. This issue is fixed in version 7.7.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-77468Medium· 6.9Lychee is a free, open-source photo-management tool
CVE-2026-77466High· 8.3Lychee is a free, open-source photo-management tool
CVE-2026-77470High· 8.3Lychee is a free, open-source photo-management tool
CVE-2026-62679High· 8.9Lychee is a free, open-source photo-management tool
CVE-2026-61611High· 7.5Lychee is a free, open-source photo-management tool
CVE-2026-61838High· 8.2Lychee is a free, open-source photo-management tool