Lychee EUVD-2026-102188

Requires an authenticated Lychee account (PR:L) with access to the POST /api/v2/Photo::fromUrl URL-import feature, and the attacker must control authoritative DNS for the submitted hostname to execute a rebinding attack. Exploitation is further limited by a timing race: the attacker must make the hostname resolve to a permitted public address during PhotoUrlRule validation and then to a private/forbidden address during the separate fopen fetch in DownloadedFile.php (hence AC:H and AT:P). Realistic impact is additionally bounded by the Lychee server's network position (what internal services are actually reachable) and by TLS behavior on the fetched connection, as noted in the advisory.

This is a low-priority vulnerability despite being a real, verified flaw. The vendor-assigned CVSS 4.0 score is 2.3 (Low), and the vector CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N shows multiple mitigating factors that compound: exploitation requires an authenticated account (PR:L), high attack complexity (AC:H), and a present attack requirement (AT:P) - the latter two reflecting the need to win a DNS-rebinding race between the TOCTOU validation check and the later fetch. Impact is constrained: the 4.0 vector records VC:N/VI:N/VA:N on the vulnerable system itself and only SI:L/SA:L on subsequent (internal) systems reachable via SSRF, meaning no direct confidentiality loss is claimed and only limited integrity/availability effect on back-end services. No EPSS score, CISA KEV listing, or public POC was provided in the input, so exploitation probability signals are all absent rather than conflicting. The one caveat worth flagging: the description notes impact is 'subject to deployment and TLS behavior,' so real-world reachability of internal services is environment-dependent and may be higher or lower than the base score implies - verify against the specific Lychee deployment's network position.

An attacker with a valid authenticated Lychee account submits a POST /api/v2/Photo::fromUrl request pointing at a hostname they control via DNS. The validation step (PhotoUrlRule) resolves the hostname to a public IP and passes, but on the subsequent fopen/download the same hostname re-resolves to an internal/forbidden address, letting the import fetch reach services on the Lychee server's internal network. No public exploit code was identified at time of analysis, and success depends on winning the DNS re-resolution race (AC:H, AT:P).