Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

lycheeorg/lychee

              master @ dcef326
            

Fixes

CVEs

HIGH

Peak severity

40.5%

Coverage

Highlights

Auth Bypass: 37 prior fixes. Scrutinize any change in this area.

app/Http/Middleware/UploadCheck.php: most-fixed (6 issues). Treat as high-risk during review.

34 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Session and state mismatches in query policies allowed access control filters to be bypassed. Ensuring explicit injection of authenticated user states and unlocked album parameters is critical to preventing unauthorized visibility of albums.

SSRF: Importing photos via user-supplied URLs has suffered from multiple SSRF bypasses, including DNS rebinding (CVE-2026-33644), loopback range evasion, and TOCTOU races. Safe implementation requires resolving and validating IP addresses before establishing any network sockets.

Auth Bypass: The upload and file modification pipeline has repeatedly bypassed ownership checks due to inconsistent parameter evaluation (such as ignoring 'parent_id' vs 'albumID' checks) and early success returns.