Lychee CVE-2026-33644

The CVSS v4.0 score of 2.3 reflects a low-severity rating constrained by multiple attack factors: the vulnerability requires authenticated access (PR:L in the vector), network-based attack delivery (AV:N), and a prerequisite condition (AT:P, indicating attack timing/DNS rebinding race condition) that elevates complexity. The confidentiality impact is limited (VC:L), with no integrity or availability impact recorded. EPSS data was not provided in the intelligence summary, but the combination of authentication requirement and timing-dependent exploitation suggests real-world exploitation probability remains low. The vulnerability does not appear in CISA KEV (no active exploitation reported), and no public proof-of-concept has been identified at time of analysis. This is a genuine SSRF issue with architectural merit-it demonstrates a common PHP validation anti-pattern-but real-world attack scenarios are constrained by the authenticated requirement and DNS rebinding complexity. Organizations running Lychee with strict network segmentation may face minimal risk; however, installations with permissive outbound network policies and untrusted user bases warrant prioritized patching.

An authenticated Lychee user (photographer, gallery administrator, or compromised account) imports a photo via the URL import feature, providing a domain name they control. Initially, their domain resolves to a benign external IP address, passing validation checks. The attacker's DNS server then responds with a rebinded IP address (e.g., 127.0.0.1 for localhost or 169.254.169.254 for AWS metadata service) on the second resolution attempt. The Lychee application fetches the resource from the rebinded address, potentially accessing internal metadata endpoints, local configuration files, or services bound to loopback interfaces, thereby leaking sensitive information to the attacker. No public proof-of-concept has been identified, but DNS rebinding is a well-known technique with multiple public tools and PoC implementations available in security research.