lychee

by lycheeversev0.24.2

Last updated Jun 8, 2026

Fast, async, stream-based link checker written in Rust

Install with winget

$ winget install --id lycheeverse.lychee --exact --version 0.24.2

Run in Command Prompt, PowerShell, or Windows Terminal. Prompts for any agreements.

Built by Pckgr

For Intune admins

Stop chasing app updates. Pckgr patches them for you.

Automated application patching for Microsoft Intune. Pckgr keeps a curated library of 1,000+ apps continuously up-to-date in your tenant via Microsoft Graph - no manual repackaging, no chasing vendor sites.

Start free 30-day trial

No credit card required.

About

Fast, async, stream-based link checker written in Rust.

Finds broken URLs and mail addresses inside Markdown, HTML, reStructuredText, websites and more!

Installers · v0.24.2

Architecture	Type	Scope	Install	Download
x64	ZIP archive	-		Direct

Copy a command tailored to that specific architecture, type, and scope - useful when winget would otherwise pick a different default.

Security

9 known CVEs via NVD

medium4.3Fix in v7.5.4CVE-2026-39957affects before 7.5.4Apr 9, 2026
Lychee is a free, open-source photo-management tool. Prior to 7.5.4, a SQL operator-precedence bug in SharingController::listAll() causes the orWhereNotNull('user_group_id') clause to escape the ownership filter applied by the when() block. Any authenticated non-admin user with...
Patch Vendor advisory
medium5.4Fix in v7.5.3CVE-2026-33738affects before 7.5.3Mar 26, 2026
Lychee is a free, open-source photo-management tool. Prior to version 7.5.3, the photo `description` field is stored without HTML sanitization and rendered using `{!! $item->summary !!}` (Blade unescaped output) in the RSS, Atom, and JSON feed templates. The `/feed` endpoint is...
Patch Vendor advisory
medium4.3Fix in v7.5.2CVE-2026-33644affects before 7.5.2Mar 26, 2026
Lychee is a free, open-source photo-management tool. Prior to version 7.5.2, the SSRF protection in `PhotoUrlRule.php` can be bypassed using DNS rebinding. The IP validation check (line 86-89) only activates when the hostname is an IP address. When a domain name is used, `filter...
Patch Vendor advisory
medium5.0Fix in v7.5.1CVE-2026-33537affects before 7.5.1Mar 26, 2026
Lychee is a free, open-source photo-management tool. The patch introduced for GHSA-cpgw-wgf3-xc6v (SSRF via `Photo::fromUrl`) contains an incomplete IP validation check that fails to block loopback addresses and link-local addresses. Prior to version 7.5.1, an authenticated user...
Patch Vendor advisory
medium4.3Fix in v7.1.0CVE-2026-22784affects before 7.1.0Jan 12, 2026
Lychee is a free, open-source photo-management tool. Prior to 7.1.0, an authorization vulnerability exists in Lychee's album password unlock functionality that allows users to gain possibly unauthorized access to other users' password-protected albums. When a user unlocks a pass...
Patch
high8.3Patched in wingetCVE-2024-25808affects v3.1.6Mar 21, 2024
Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create new album function.
medium6.1Patched in wingetCVE-2024-25807affects v3.1.6Mar 21, 2024
Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title parameter when creating an album.
high8.8Patched in wingetCVE-2023-52082affects before 5.0.2Dec 28, 2023
Lychee is a free photo-management tool. Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the `.env` settings set to DB_LOG_SQL=true and DB_LOG_SQL_EXPLAIN=true. The defaults settings o...
Patch Vendor advisory

Showing 8 of 9. Source: NVD, updated 2h ago. Patch status is best-effort: NVD's fix version is compared against the latest version in winget, but the two version formats don't always align. Confirm with the vendor advisory before treating any specific build as safe.

See a CVE that affects your fleet? Push the patched version to Intune in one click with Pckgr - automated patching is the only way to keep up.

Related apps

BrowserSelect — select browser dynamicallyzumoshi
zumoshi.BrowserSelectv1.4.1
Browser Select is a utility to dynamically select the browser you want instead of just having one default for all links.
Steam LinkValve Corporation
Valve.SteamLinkv1.3.30
Steam Link connects your device to any computer that's running Steam.
Link Shell ExtensionHermann Schinagl
HermannSchinagl.LinkShellExtensionv3.9.3.5
Explorer extension for easy creation of Hardlinks, Junctions, Volume Mountpoints and Symbolic Links
CppcheckThe Cppcheck team
Cppcheck.Cppcheckv2.21.0
Cppcheck is a static analysis tool for C/C++ code.
UWPHookBriano
brianlima.uwphookv2.14.3
link UWP games and XboxGamePass to Steam
C
Config File ValidatorBoeing
Boeing.config-file-validatorv2.2.2
A cross-platform CLI tool to validate different configuration file types

More from lycheeverse or browse broken-links, check, link.

Frequently asked questions

How do I install lychee on Windows?

Open Windows Terminal, PowerShell, or Command Prompt and run: winget install --id lycheeverse.lychee --exact --version 0.24.2. winget downloads the installer from lycheeverse and runs it. Requires Windows 10 (1809+) or Windows 11.

How do I install lychee silently for unattended deployment?

Add --silent and accept the agreements upfront: winget install --id lycheeverse.lychee --exact 0.24.2 --silent --accept-package-agreements --accept-source-agreements. This is the variant Intune, Configuration Manager, and other deployment tools should use.

How do I uninstall lychee via winget?

Run: winget uninstall --id lycheeverse.lychee --exact. Add --silent for unattended uninstalls. winget will use the registered uninstaller from lychee's Apps & Features entry.

Is lychee free?

lychee is distributed under Apache-2.0. Refer to the publisher (https://github.com/lycheeverse/lychee) for the full license terms - Wingetly itself does not charge for installation.

Does lychee work on Windows 10?

Yes, as long as your Windows 10 build supports winget (1809 or newer). winget ships with App Installer on Windows 10/11 and pulls lychee directly from the publisher.

How do I keep lychee up to date?

Run winget upgrade --id lycheeverse.lychee --exact, or winget upgrade --all to update everything winget tracks. We index 10 versions of lychee from microsoft/winget-pkgs.

Recent versions

0.24.2latest
0.23.0
0.22.0
0.20.1
0.20.0
0.19.1
0.18.1
0.18.0
0.17.0
0.16.1