Lychee CVE-2026-33537

The CVSS v4.0 score of 5.3 reflects a moderate risk profile with network-accessible attack vector, low attack complexity, and requirement for low-privilege authentication. The vector indicates low confidentiality impact with no integrity or availability impact (VC:L/VI:N/VA:N). While the CVSS severity is moderate, the practical risk is constrained by three key factors: (1) authentication is required, reducing the pool of potential attackers to users with valid Lychee accounts; (2) the impact is limited to information disclosure from internal services reachable via loopback or link-local addresses, not remote code execution; and (3) no public exploit code or CISA KEV designation has been identified, suggesting limited real-world exploitation pressure. However, for organizations running Lychee in security-sensitive environments (especially where internal services are exposed on loopback interfaces), this represents a meaningful bypass of defense-in-depth controls that may warrant prioritized patching. The incomplete nature of the IP validation-affecting all four protection configuration settings-indicates a systematic implementation flaw rather than an edge case.

An authenticated Lychee user with permission to import photos via URL crafts a request to Photo::fromUrl with a target address of 127.0.0.1:6379 (or similar loopback address) to probe an internal Redis instance, or uses fe80::1 to access link-local services such as cloud metadata endpoints or internal management interfaces. Because the IP validation does not properly block these address ranges, the request reaches the internal service, allowing the attacker to leak sensitive configuration, credentials, or service metadata. This requires valid authentication to the Lychee application itself, limiting the threat to insider threats or compromised user accounts.