Repository navigation
[BUG] Public album images return HTTP 418 — SecurePathController rejects /pictures #93
Description
Is there an existing issue for this?
- I have searched the existing issues
Current Behavior
Since the recent rebuild, public album images don't load for logged-out visitors (HTTP 418). Logged in, they work fine.
Recent Lychee hardened SecurePathController to only accept paths under /app/www/public/uploads/, but this image stores uploads in /pictures — so every anonymous image request is rejected as path traversal:
production.ERROR: Invalid path for secure path request. {"path":"/pictures/medium/de/fd/<redacted>.JPG","valid_path_start":"/app/www/public/uploads/"}
App\Http\Controllers\SecurePathController::__invoke:75 Invalid path for secure path request.
Logged-in works because the owner route bypasses this check; only the public secure-link path is affected.
Expected Behavior
Public album images should be served to anonymous visitors — the /pictures layout needs to be reconciled with the new valid_path_start whitelist.
Steps To Reproduce
- Create a public album, upload photos.
- Open the album URL while logged out → images fail with 418.
- Log in → images load.
Environment
- Image build: `v7.6.4-ls53` (build-date `2026-06-26`)
- Reproducible regardless of reverse proxy; `APP_URL` / `TRUSTED_PROXIES` are set correctly.CPU architecture
x86-64
Docker creation
services:
lychee:
image: lscr.io/linuxserver/lychee:latest
container_name: lychee
environment:
- PUID=1000
- PGID=1000
- TZ=Etc/UTC
- APP_URL=https://<domain>
- TRUSTED_PROXIES=<proxy-ip>
- DB_CONNECTION=mysql
- DB_HOST=<db-host>
- DB_PORT=3306
- DB_DATABASE=<db-name>
- DB_USERNAME=<db-user>
- DB_PASSWORD=<redacted>
volumes:
- ./config:/config
- ./pictures:/pictures
restart: unless-stoppedContainer logs
[migrations] started
[migrations] 01-nginx-site-confs-default: skipped
[migrations] 02-default-location: skipped
[migrations] done
───────────────────────────────────────
██╗ ███████╗██╗ ██████╗
██║ ██╔════╝██║██╔═══██╗
██║ ███████╗██║██║ ██║
██║ ╚════██║██║██║ ██║
███████╗███████║██║╚██████╔╝
╚══════╝╚══════╝╚═╝ ╚═════╝
Brought to you by linuxserver.io
───────────────────────────────────────
To support LSIO projects visit:
https://www.linuxserver.io/donate/
───────────────────────────────────────
GID/UID
───────────────────────────────────────
User UID: 1000
User GID: 1000
───────────────────────────────────────
Linuxserver.io version: v7.6.4-ls53
Build-date: 2026-06-26T20:54:38+00:00
───────────────────────────────────────
using keys found in /config/keys
Waiting for DB to be available
INFO Nothing to migrate.
[custom-init] No custom files found, skipping...
[ls.io-init] done.
INFO No scheduled commands are ready to run.
INFO No scheduled commands are ready to run.
INFO No scheduled commands are ready to run.
INFO No scheduled commands are ready to run.
INFO No scheduled commands are ready to run.
INFO No scheduled commands are ready to run.
INFO No scheduled commands are ready to run.
INFO No scheduled commands are ready to run.
INFO No scheduled commands are ready to run.
INFO No scheduled commands are ready to run.
INFO No scheduled commands are ready to run.
Activity
github-actions commentedon Jun 28, 2026
Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.
thespad commentedon Jun 28, 2026
I can't replicate this with the latest image, both logged in and out I can access public albums
Can you try setting
LYCHEE_UPLOADS=/picturesas part of your environment and see if that makes any difference?