Lychee’s Photo::fromUrl endpoint validates a hostname and its resolved addresses before download, but later re‑uses the original hostname when opening the file. This flaw allows an authenticated attacker who can control DNS responses to force the server to obtain a public address during validation and later resolve the same hostname to a private or otherwise restricted IP. The attacker can use this to query internal services from the Lychee host, bypassing the intended server‑side request forgery controls. The vulnerability is thus a Server Side Request Forgery (SSRF) that can expose internal network resources.

Lychee versions before 7.6.0 are affected. The affected product is Lychee.org’s Lychee photo‑management application; any deployment using a version earlier than 7.6.0 without the 7.6.0 patch is at risk.

The vulnerability has a CVSS score of 2.3, indicating low severity, and an EPSS score of less than 1%, suggesting a very low probability of exploitation. It is not listed in the CISA KEV catalog. Exploitation requires an authenticated user and the ability to influence DNS resolution for the target hostname. The likely attack path involves the attacker owning or controlling the DNS records for a hostname passed to Photo::fromUrl, causing the Lychee server to resolve to an internal IP after initial validation passed. Under these conditions the server can reach services that are only accessible from the internal network.