Which versions of PHP are affected by CVE-2026-33644?

CVE-2026-33644 is a low-severity vulnerability in Lychee involving SSRF (CVSS 2.3).. A patch is available.

How to fix or mitigate CVE-2026-33644?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

PHP CVE-2026-33644

Q: What is the CVSS score of CVE-2026-33644?

CVE-2026-33644 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16374 LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-26 GitHub_M

SSRF PHP

2.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

7.5.2

EUVD ID Assigned

Mar 26, 2026 - 20:31 euvd

EUVD-2026-16374

Analysis Generated

Mar 26, 2026 - 20:31 vuln.today

CVE Published

Mar 26, 2026 - 20:04 nvd

LOW 2.3

DescriptionGitHub Advisory

Lychee is a free, open-source photo-management tool. Prior to version 7.5.2, the SSRF protection in PhotoUrlRule.php can be bypassed using DNS rebinding. The IP validation check (line 86-89) only activates when the hostname is an IP address. When a domain name is used, filter_var($host, FILTER_VALIDATE_IP) returns false, skipping the entire check. Version 7.5.2 patches the issue.

AnalysisAI

DNS rebinding bypasses SSRF protection in Lychee photo-management tool versions prior to 7.5.2, allowing authenticated remote attackers to access restricted internal resources by providing domain names instead of IP addresses to the photo URL import feature. The vulnerability exploits a logic flaw in PhotoUrlRule.php where hostname validation only applies to IP addresses, leaving domain-based requests unvalidated. Vendor-released patch available (version 7.5.2); no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability exists in Lychee (CPE: cpe:2.3:a:lycheeorg:lychee:*:*:*:*:*:*:*:*), a PHP-based open-source photo management application. The root cause is classified under CWE-918 (Server-Side Request Forgery), specifically a logic flaw in the IP validation routine within PhotoUrlRule.php. The vulnerable code at lines 86-89 uses PHP's filter_var($host, FILTER_VALIDATE_IP) function to detect and block private/reserved IP addresses. However, this validation only executes when the hostname parameter is directly an IP address string. When users provide fully qualified domain names (FQDNs), filter_var() returns false, causing the conditional block to be skipped entirely. An attacker can then leverage DNS rebinding-a technique where a domain name resolves to a different IP address on subsequent queries-to initially pass domain validation and later resolve to internal resources (e.g., 127.0.0.1, 192.168.x.x, or cloud metadata endpoints). This bypasses the intended SSRF boundary enforcement.

RemediationAI

Upgrade Lychee to version 7.5.2 or later immediately via your package manager or direct GitHub release download (https://github.com/LycheeOrg/Lychee). Verify the patched version includes the fix committed at https://github.com/LycheeOrg/Lychee/commit/28c5261fb9deab4f9420c8cc2f73a87425939107. Until patching is feasible, implement network-level controls: restrict outbound HTTP/HTTPS access from the Lychee application to known-safe ranges, disable photo URL import functionality via application configuration if available, and enforce strict firewall rules preventing connections to private network ranges (RFC 1918, 169.254.x.x, 127.x.x.x). Monitor application logs for unusual URL import requests containing domain names that resolve to internal infrastructure. Additionally, review and harden DNS resolver configuration to mitigate DNS rebinding attacks (e.g., use DNS rebinding protection in corporate DNS appliances).