CVE-2024-25808: Lycheeorg Lychee

High severity, CVSS 8.3. EPSS: 0.4% chance of exploitation in the next 30 days.

Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create new album function.

Affected products

Published 2024-03-22. Last modified 2026-06-17.