EUVD-2026-16369Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
Lychee is a free, open-source photo-management tool. The patch introduced for GHSA-cpgw-wgf3-xc6v (SSRF via Photo::fromUrl) contains an incomplete IP validation check that fails to block loopback addresses and link-local addresses. Prior to version 7.5.1, an authenticated user can still reach internal services using direct IP addresses, bypassing all four protection configuration settings even when they are set to their secure defaults. Version 7.5.1 contains a fix for the issue.
AnalysisAI
Incomplete IP validation in Lychee's SSRF protection mechanism allows authenticated users to bypass all four security configuration settings by leveraging loopback and link-local addresses, enabling access to internal services. The vulnerability affects Lychee versions prior to 7.5.1 and requires prior authentication but carries low confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis, though the attack vector is network-accessible and requires minimal complexity.
Technical ContextAI
Lychee (cpe:2.3:a:lycheeorg:lychee:*:*:*:*:*:*:*:*) is an open-source photo management application that implements Server-Side Request Forgery (SSRF) protections in its Photo::fromUrl functionality. The vulnerability is classified under CWE-918 (Server-Side Request Forgery), which occurs when a web application fetches remote resources without adequate validation of the target address. The initial patch for GHSA-cpgw-wgf3-xc6v introduced IP address validation logic, but the implementation was incomplete-it failed to properly detect and block IPv4 loopback ranges (127.0.0.0/8), IPv6 loopback (::1), and link-local address ranges (169.254.0.0/16 for IPv4 and fe80::/10 for IPv6). This allows an authenticated attacker to craft requests to internal services by bypassing the intended network segmentation controls.
RemediationAI
Upgrade Lychee to version 7.5.1 or later, which contains the corrected IP validation logic for loopback and link-local address ranges. The fix is available in the upstream repository at commit 41386677681d18cd04e42a35b50bd88bf53a4a6a. Until patching is feasible, operators should enforce network-level controls by restricting outbound connections from the Lychee service to trusted internal IP ranges, disable the Photo::fromUrl feature if not required, and review authentication policies to limit photo import functionality to trusted administrative users only. Consult https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-vq6w-prpf-h287 for vendor-specific mitigation recommendations.
Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary co
Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain s
Lychee is a free photo-management tool. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Lychee photo management tool versions before 7.1.0 contain an authorization bypass in the album password unlock mechanis
Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in php/Access/Guest.php. Rated medium severit
Stored cross-site scripting (XSS) in Lychee photo-management application versions prior to 7.5.3 allows unauthenticated
DNS rebinding bypasses SSRF protection in Lychee photo-management tool versions prior to 7.5.2, allowing authenticated r
SQL operator-precedence bug in Lychee prior to 7.5.4 allows authenticated users with upload permission to bypass ownersh
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today