Medium severity · published Mar 26, 2026
CVE-2026-33537
Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked
5.0
CVSS
0.3%
EPSS
No
On KEV
Description
Lychee is a free, open-source photo-management tool. The patch introduced for GHSA-cpgw-wgf3-xc6v (SSRF via `Photo::fromUrl`) contains an incomplete IP validation check that fails to block loopback addresses and link-local addresses. Prior to version 7.5.1, an authenticated user can still reach internal services using direct IP addresses, bypassing all four protection configuration settings even when they are set to their secure defaults. Version 7.5.1 contains a fix for the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LY
Lychee · LycheeOrg
< 7.5.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33537
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-33537
Patch
https://github.com/LycheeOrg/Lychee/commit/41386677681d18cd04e42a35b50bd88bf53a4a6a
Exploit
https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-vq6w-prpf-h287
More from Lychee
9.8
CVE-2023-52082
Lychee is a free photo-management tool
8.9
CVE-2026-62679
Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read
8.3
CVE-2026-77466
Lychee: Webshop payment bypass via unrestricted "Dummy" gateway selection
8.3
CVE-2026-77470
Lychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST request
8.3
CVE-2024-25808
Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create new album function