The vulnerability stems from a flaw in Lychee’s SSRF filter, which verifies only literal IP addresses. When the application receives a domain name that resolves to a private network address, the IP‐validation step is bypassed, permitting outbound HTTP requests to internal resources. This can expose sensitive services or data on the internal network and provide a foothold for further attacks. The weakness is an SSRF scenario, classed as a server‑side request forgery.

Lychee installations from the official repository before version 7.5.2 are affected. Any deployment running these releases that processes external URLs through the PhotoUrlRule component is vulnerable.

The assigned CVSS score of 2.3 reflects a low severity level; no EPSS score is available and the issue is not listed in the CISA known‑exploited vulnerabilities catalog. Exploiting the flaw requires an attacker to craft a DNS rebinding attack that forces the Lychee server to resolve a domain to an internal IP address. While this does not grant code execution on the host, it enables the attacker to probe or communicate with services behind the firewall, depending on the internal network’s exposure.