CVE-2026-33644: Lychee has SSRF bypass via DNS rebinding — PhotoUrlRule only validates IP addresses, not hostnames resolving to internal IPs
Lychee is a free, open-source photo-management tool. Prior to version 7.5.2, the SSRF protection in PhotoUrlRule.php can be bypassed using DNS rebinding. The IP validation check (line 86-89) only activates when the hostname is an IP address. When a domain name is used, filtervar($host, FILTERVALIDATEIP) returns false, skipping the entire check. Version 7.5.2 patches the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33644?
CVE-2026-33644 is considered a high severity vulnerability due to its potential for remote code execution via SSRF attacks.
How do I fix CVE-2026-33644?
To fix CVE-2026-33644, upgrade Lychee to version 7.5.2 or later where the DNS rebinding vulnerability is patched.
What type of vulnerability is CVE-2026-33644?
CVE-2026-33644 is an SSRF (Server-Side Request Forgery) vulnerability that can be exploited through DNS rebinding.
Which versions of Lychee are affected by CVE-2026-33644?
Versions of Lychee prior to 7.5.2 are vulnerable to CVE-2026-33644 and should be updated immediately.
What is the impact of CVE-2026-33644?
The impact of CVE-2026-33644 includes the potential for unauthorized access to internal services and sensitive information through SSRF exploitation.