CVE-2026-33537

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33537
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33537.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-33537
Aliases
  • GHSA-vq6w-prpf-h287
Published
2026-03-26T20:01:19.377Z
Modified
2026-07-15T01:49:06.628566944Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N CVSS Calculator
Summary
Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked
Details

Lychee is a free, open-source photo-management tool. The patch introduced for GHSA-cpgw-wgf3-xc6v (SSRF via Photo::fromUrl) contains an incomplete IP validation check that fails to block loopback addresses and link-local addresses. Prior to version 7.5.1, an authenticated user can still reach internal services using direct IP addresses, bypassing all four protection configuration settings even when they are set to their secure defaults. Version 7.5.1 contains a fix for the issue.

Database specific 
{
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33537.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/lycheeorg/lychee

Affected ranges

Type
GIT
Repo
https://github.com/lycheeorg/lychee
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
41386677681d18cd04e42a35b50bd88bf53a4a6a
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:lycheeorg:lychee:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "7.5.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v4.*
v4.0.0
v4.0.0-alpha.1
v4.0.0-beta.1
v4.0.0-beta.2
v4.0.1
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.1.0
v4.10.0
v4.11.0
v4.11.1
v4.12.0
v4.13.0
v4.2.0
v4.2.1
v4.2.2
v4.3.0
v4.3.4
v4.3.5
v4.3.6
v4.4.0
v4.5.0
v4.5.1
v4.5.2
v4.5.3
v4.6.0
v4.6.0-RC
v4.6.0-RC2
v4.6.0-RC3
v4.6.1
v4.6.1-RC1
v4.6.1-RC2
v4.6.2
v4.6.2-RC1
v4.6.2-RC2
v4.6.3-RC1
v4.6.4
v4.6.5
v4.7.0
v4.7.1
v4.7.2
v4.7.3
v4.7.4
v4.8.0
v4.8.1
v4.9.0
v4.9.1
v4.9.2
v4.9.3
v4.9.3-RC
v4.9.4
v5.*
v5.0.0
v5.0.0-beta
v5.0.1
v5.0.2
v5.0.3
v5.1.0
v5.1.1
v5.1.2
v5.2.0
v5.2.1
v5.2.2
v5.3.0
v5.3.1
v5.4.0
v5.5.0
v5.5.1
v6.*
v6.0.0
v6.0.1
v6.1.0
v6.1.1
v6.1.2
v6.10.0
v6.10.1
v6.10.2
v6.10.3
v6.10.4
v6.2.0
v6.3.0
v6.3.1
v6.3.2
v6.3.3
v6.3.4
v6.3.5
v6.4.0
v6.4.1
v6.4.2
v6.5.0
v6.5.1
v6.5.2
v6.5.3
v6.6.0
v6.6.1
v6.6.10
v6.6.11
v6.6.12
v6.6.13
v6.6.14
v6.6.2
v6.6.3
v6.6.4
v6.6.5
v6.6.6
v6.6.7
v6.6.8
v6.6.9
v6.7.0
v6.7.1
v6.7.2
v6.8.0
v6.8.1
v6.9.0
v6.9.1
v6.9.2
v6.9.3
v6.9.4
v7.*
v7.0.0
v7.0.1
v7.1.0
v7.1.1
v7.1.2
v7.2.0
v7.2.1
v7.3.0
v7.3.1
v7.3.2
v7.3.3
v7.4.0
v7.4.1
v7.4.2
v7.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33537.json"