CVE-2026-33537: Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked
Lychee is a free, open-source photo-management tool. The patch introduced for GHSA-cpgw-wgf3-xc6v (SSRF via Photo::fromUrl) contains an incomplete IP validation check that fails to block loopback addresses and link-local addresses. Prior to version 7.5.1, an authenticated user can still reach internal services using direct IP addresses, bypassing all four protection configuration settings even when they are set to their secure defaults. Version 7.5.1 contains a fix for the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33537?
CVE-2026-33537 is considered a high-severity vulnerability due to its potential for SSRF attacks.
How do I fix CVE-2026-33537?
To fix CVE-2026-33537, update to the latest version of Lychee beyond 7.5.1 which addresses the incomplete IP validation.
What is the impact of CVE-2026-33537 on Lychee?
CVE-2026-33537 can allow attackers to bypass IP restrictions and access internal services, leading to potential data exposure.
What versions of Lychee are affected by CVE-2026-33537?
Lychee versions up to 7.5.1 are affected by CVE-2026-33537.
Can CVE-2026-33537 be exploited remotely?
Yes, CVE-2026-33537 can be exploited remotely by sending specially crafted requests to the Lychee application.