CVE-2026-77467

Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee enables ImageMagick PDF support with Ghostscript but does not apply an effective pre-render limit to PDF page dimensions in ImagickHandler::loadPdf(). An authenticated user who can upload a small PDF with an oversized /MediaBox can cause Imagick::readImage() to consume substantial CPU before failing to produce an image. When QUEUE_CONNECTION selects synchronous processing the request can occupy a web worker, while the official asynchronous Docker configuration can clog the shared image-processing queue and delay other work. The advisory did not identify a Ghostscript sandbox escape. This issue is fixed in version 7.7.0.

• CWE-400
• CWE-770

• https://github.com/LycheeOrg/Lychee/commit/1e92846af4c2d259a225cf4517de17efba04f945
• https://github.com/LycheeOrg/Lychee/pull/4511
• https://github.com/LycheeOrg/Lychee/releases/tag/v7.7.0
• https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-6736-fhxv-3p79
• https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-6736-fhxv-3p79

Published

Oct 15, 2026

Last Modified

Oct 20, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77454Incorrect Authorization vulnerability in ash-project ash_sql…5.9
• CVE-2026-77459Argo CD is a declarative, GitOps continuous delivery tool fo…9.9
• CVE-2026-7746A vulnerability was identified in SourceCodester Web-based P…6.3
• CVE-2026-77460EspoCRM is an open source customer relationship management a…6.5
• CVE-2026-77465toml-node is a TOML parser for Node.js and the browser. Prio…7.5
• CVE-2026-77466Lychee is a free, open-source photo-management tool. Prior t…8.3
• CVE-2026-77468Lychee is a free, open-source photo-management tool. Prior t…6.9
• CVE-2026-7747A security flaw has been discovered in Totolink N300RH 3.2.4…9.8
• CVE-2026-77470Lychee is a free, open-source photo-management tool. Prior t…8.3
• CVE-2026-77474destructive_command_guard (dcg) is a command-line safety too…7.1
• CVE-2026-7748A weakness has been identified in Totolink N300RH 3.2.4-B202…8.8
• CVE-2026-77480Insufficient granularity of access control in SQL Server all…8.8