CVE-2023-52082 - CVE House
Back to Database
Status published High CVE-2023-52082

Lychee is vulnerable to an SQL Injection in explain DB queries.

Vulnerability Description

Lychee is a free photo-management tool. Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the `.env` settings set to DB_LOG_SQL=true and DB_LOG_SQL_EXPLAIN=true. The defaults settings of Lychee are safe. The patch is provided on version 5.0.2. To work around this issue, disable SQL EXPLAIN logging.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-52082

Credits & Attribution

No credits recorded in the NVD database.

References

More from LycheeOrg

View All →
CVE-2025-53018
Lychee has Server-Side Request Forgery (SSRF) in Photo::fromUrl API via unvalidated remote image URLs
Low 3
CVE-2025-50202
Lychee Path Traversal Vulnerability
High 7.5

Affected Vendor

Affected Software

Lychee
Vulnerable Versions:
< 5.0.2

Timeline

Official Publish: December 28th, 2023
Last Modified: November 27th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-89

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1213.006 Databases
Collection
T1485 Data Destruction
Impact