CVE-2026-71805

CVSS 9.8 (critical) · published 2026-09-09

An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. Unauthenticated remote attackers can upload arbitrary files and write them outside the intended storage directory via the directory parameter in POST /app-api/infra/file/upload.

Weakness: CWE-434

Source: NVD CVE-2026-71805

References

• https://github.com/W000i/vuln/issues/9
• https://github.com/W000i/vuln/issues/9

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.