Read the docs
TI-2026-25930 Aliases CVE-2026-33537

Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked

Priority MEDIUM 57CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

Lychee is a free, open-source photo-management tool. The patch introduced for GHSA-cpgw-wgf3-xc6v (SSRF via `Photo::fromUrl`) contains an incomplete IP validation check that fails to block loopback addresses and link-local addresses. Prior to version 7.5.1, an authenticated user can still reach internal services using direct IP addresses, bypassing all four protection configuration settings even when they are set to their secure defaults. Version 7.5.1 contains a fix for the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0027 19th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Lychee (LycheeOrg): 7.5.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LycheeOrgLycheebefore 7.5.17.5.1Patch availableCNA
  • Lychee VendorLycheeOrg Affected before 7.5.1 Fixed in 7.5.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:lycheeorg:lychee:*:*:*:*:*:*:*:*before 7.5.1VulnerableLycheeOrg
  • cpe:2.3:a:lycheeorg:lychee:*:*:*:*:*:*:*:* Versions before 7.5.1 Vulnerable ·LycheeOrg

Remediation

  • Fix · CNA Lychee (LycheeOrg) Fixed in 7.5.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33537

References

Exploit 1

Patch 1

  • TI-2024-16953 Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote… CVSS 3.1HIGH 8.3
  • TI-2024-16952 Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to… CVSS 3.1MEDIUM 6.1
  • TI-2026-26117 Lychee Vulnerable to Stored XSS via Photo Description in RSS/Atom/JSON Feed (No Sanitization on Public Endpoint) CVSS 4.0MEDIUM 4.8
  • TI-2026-28813 Incorrect authorization in LycheeOrg Lychee CVSS 4.0LOW 2.3
  • TI-2023-28525 Lychee is vulnerable to an SQL Injection in explain DB queries. CVSS 3.1CRITICAL 9.8
  • TI-2021-19511 Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in… CVSS 3.1MEDIUM 6.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences