Lychee, a free photo‑management tool, contains a flaw that allows attackers to perform server‑side request forgery by bypassing DNS rebinding protection. In PhotoUrlRule.php, the check that validates an IP address is only executed when the hostname supplied is an IP literal. When a hostname that resolves to an internal IP is used, the validation is skipped, permitting the application to fetch arbitrary resources from internal networks. This can expose sensitive internal services or data to unauthorized parties.

The vulnerability affects Lychee versions prior to 7.5.2. The product is Lychee by LycheeOrg. All releases before 7.5.2 are susceptible to the SSRF bypass demonstrated.

The CVSS base score is 2.3, indicating low severity, and the EPSS score is less than 1%, with no listing in the CISA KEV catalog, suggesting a low likelihood of widespread exploitation. However, the flaw is remotely exploitable via a DNS rebinding attack: an attacker registers a DNS record that resolves to an internal IP and supplies that hostname to the PhotoUrlRule endpoint. The application then performs an outbound request to the internal resource, bypassing the intended IP check. Because this requires only an HTTP request to the vulnerable endpoint, an attacker with internet access to the Lychee instance can exploit the issue to probe or reach private network services.