Threat database

LZ-litchi version 1.0.0 contains a critical vulnerability that allows unauthenticated remote attackers to upload arbitrary files and perform path traversal via the directory parameter in the file upload API endpoint. This can lead to files being written outside the intended storage directory, potentially resulting in full system compromise.