From 3a820808023f72e047be1d4370446748f0a2f7d8 Mon Sep 17 00:00:00 2001 From: ildyria Date: Mon, 31 Aug 2026 19:12:02 +0200 Subject: [PATCH 1/3] More researchers --- src/pages/support.astro | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/src/pages/support.astro b/src/pages/support.astro index aefc0382..6f111b37 100644 --- a/src/pages/support.astro +++ b/src/pages/support.astro @@ -374,6 +374,41 @@ const metadata = { src: 'https://avatars.githubusercontent.com/u/298925831?v=4', alt: 'skeletonsec', }, + }, + { + title: 'Zyy0530 (Ziyue Wang)', + image: { + src: 'https://avatars.githubusercontent.com/u/202744044?v=4', + alt: 'Zyy0530', + }, + }, + { + title: 'lzhou1110 (Liyi Zhou)', + image: { + src: 'https://avatars.githubusercontent.com/u/12844719?v=4', + alt: 'lzhou1110', + }, + }, + { + title: 'Str1ckl4nd (Strick Sheng)', + image: { + src: 'https://avatars.githubusercontent.com/u/73695323?v=4', + alt: 'Str1ckl4nd', + }, + }, + { + title: 'mauriceng98 (Maurice Ng)', + image: { + src: 'https://avatars.githubusercontent.com/u/97803816?v=4', + alt: 'mauriceng98', + }, + }, + { + title: '7thParkk (Chenchen Yu)', + image: { + src: 'https://avatars.githubusercontent.com/u/91473103?v=4', + alt: '7thParkk', + }, } ]} From 98ce903e6165c94197c877a6b991d324676da29f Mon Sep 17 00:00:00 2001 From: ildyria Date: Tue, 1 Sep 2026 21:35:12 +0200 Subject: [PATCH 2/3] Version 7.8.3 --- .../docs/docs/getting-started/releases.md | 23 +++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/src/content/docs/docs/getting-started/releases.md b/src/content/docs/docs/getting-started/releases.md index b1d53013..5cf20868 100644 --- a/src/content/docs/docs/getting-started/releases.md +++ b/src/content/docs/docs/getting-started/releases.md @@ -11,6 +11,29 @@ sidebar: ## Version 7 +### v7.8.3 + +Released on September 1st, 2026 + +### Security Fixes + +A group of researchers from the University of Sydney had some fun trying to find ways to break Lychee. +They found a few vulnerabilities and reported them to us. These issues are classified as moderate/high severity, but their real-world impact is limited: most require that the attacker already have upload rights, a prerequisite that doesn't apply to most Lychee deployments. +Nevertheless, as a commitment to security, we have fixed these issues in a timely manner and are releasing this hotfix to address them. + +* `fix` #4687 : Avoid naughty pdf uploaders by @ildyria. + > A user could upload a pdf crafted to exhaust the computational power of the server and cause a denial of service. This is now fixed. + > There was already mitigations in place, but they were not sufficient to avoid this issue. +* `fix` #4696 : Fix replay upload in the same chunk by @ildyria. + > A malicious user with upload access could replay the upload of chunks and subsequently fill the storage of the server without limit. + > We now ensure that the chunks are processed in order and that the same chunk cannot be uploaded twice. +* `fix` #4698 : Avoid email oracle on registration by @ildyria. + > When regitration page is disabled, a user could still send requests to the endpoint and try url. As the check for the authorization of the + > request was after the check of uniqueness of the email, an attacker could infer whether the email was used or not. This is now fixed. +* `fix` #4700 : Prevent editing pictures if they are not validated yet by @ildyria. + > When a photo is flagged for moderation, a user could still send a request to put the unvalidated photo as a cover of an album. + > This is now fixed. + ### v7.8.2 Released on August 30th, 2026 From 67d1be047dd2784fa389eaccaf5416a39df999ee Mon Sep 17 00:00:00 2001 From: ildyria Date: Tue, 1 Sep 2026 21:36:53 +0200 Subject: [PATCH 3/3] release --- src/data/releases.ts | 1 + 1 file changed, 1 insertion(+) diff --git a/src/data/releases.ts b/src/data/releases.ts index 9617980c..f01a179c 100644 --- a/src/data/releases.ts +++ b/src/data/releases.ts @@ -8,6 +8,7 @@ export interface Release { // Release data extracted from releases.md export const releases: Release[] = [ + { version: 'v7.8.3', date: 'Sep 1, 2026', title: 'Hotfix', type: 'security', highlights: ['Fixes four vulnerabilities reported by researchers from the University of Sydney'] }, { version: 'v7.8.2', date: 'Aug 30, 2026', title: 'Fixes', type: 'bugfix', highlights: ['Fixes missing migration on album configuration for photo ordering'] }, { version: 'v7.8.1', date: 'Aug 30, 2026', title: 'Fixes', type: 'bugfix', highlights: ['Fixes missing migration on album configuration for sub-album ordering'] }, { version: 'v7.8.0', date: 'Aug 29, 2026', title: 'Dropping ordering by Descriptions', type: 'enhancement', highlights: ['Improved support for title ordering', 'Dropped sort by description', 'Metadata persistence in photos files'] },