An authenticated user can exploit a flaw in Lychee’s Photo::fromUrl method that does not block loopback or link‑local IP addresses. The incomplete IP validation lets attackers force the application to issue requests to arbitrary internal addresses, thereby bypassing the four protection settings even when they are set to secure defaults. The result is unauthorized access to internal services or data, compromising the confidentiality and integrity of resources behind the network firewall.

Soft‑ware installations of Lychee released before version 7.5.1 are affected. The vulnerability sits in the Photo::fromUrl functionality used when importing images via external URLs. Users running any pre‑7.5.1 release of Lychee’s open‑source photo‑management tool are at risk.

The problem carries a CVSS score of 5.3, indicating moderate severity. No EPSS score is available and the issue is not listed in CISA’s KEV catalog. Exploitation requires a valid user session within the Lychee instance; the attacker supplies a target IP. Because the flaw bypasses all configured safeguards, the risk of internal network compromise is significant for deployments that do not restrict internal service access and run older releases.