Authenticated file read via pre-canonicalization path-prefix validation

Path traversal in Lychee before 7.6.4 allows remote authenticated users to read server files through SecurePathController image requests. The controller checks a concatenated storage-path prefix before filesystem operations resolve attacker-controlled encoded dot segments, allowing reads outside the storage root. Exploitation requires temporary_image_link_enabled enabled with temporary_image_link_when_logged_in and secure_image_link_enabled disabled; readable files include private images and application configuration containing credentials.