Lychee allows authenticated users to request arbitrary URLs through the Photo::fromUrl function. The validation that should reject loopback and link‑local IPs is incomplete, letting attackers use internal IP addresses to reach services on the same host or local network, thereby bypassing all four protection settings even when they are at their secure defaults. This flaw enables disclosure or manipulation of internal resources without requiring external network access.

All Lychee installations prior to version 7.5.1 are susceptible. Versions 7.5.1 and later contain a fix that correctly blocks loopback and link‑local addresses.

The CVSS score of 5.3 indicates a moderate impact, and the EPSS score of less than 1 % suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Because it requires an authenticated user, the risk is confined to internal accounts that can submit URLs via Photo::fromUrl, but once exploited, the attacker can access sensitive internal services.