VYPR
← All advisories
High severity8.8NVD Advisory· Published Dec 28, 2023· Updated Jun 17, 2026

CVE-2023-52082

CVE-2023-52082

Description

Lychee is a free photo-management tool. Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the .env settings set to DB_LOG_SQL=true and DB_LOG_SQL_EXPLAIN=true. The defaults settings of Lychee are safe. The patch is provided on version 5.0.2. To work around this issue, disable SQL EXPLAIN logging.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Lycheeorg/Lychee3 versions
    cpe:2.3:a:lycheeorg:lychee:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:lycheeorg:lychee:*:*:*:*:*:*:*:*range: >=4.9.3,<5.0.2
    • (no CPE)range: <5.0.2
    • (no CPE)range: < 5.0.2

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.