CVE-2026-33537CWE-918

Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked

Medium · published March 26, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
22.7
In the wild
Unconfirmed
What it is

Lychee is a free, open-source photo-management tool. The patch introduced for GHSA-cpgw-wgf3-xc6v (SSRF via `Photo::fromUrl`) contains an incomplete IP validation check that fails to block loopback addresses and link-local addresses. Prior to version 7.5.1, an authenticated user can still reach internal services using direct IP addresses, bypassing all four protection configuration settings even when they are set to their secure defaults. Version 7.5.1 contains a fix for the issue.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00311 · 22.7th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-03-26T20:01Z
EPSS history
Timeline
  • 26 MAR 20:01Z
    Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked
    cvelistv5