Lychee, an open-source photo-management tool, had an SSRF vulnerability (CWE-918) in versions before 7.5.2. The vulnerability arises because the IP validation check in PhotoUrlRule.php only activates if the hostname is an IP address. When a domain name is used, the validation is skipped due to the use of filter_var with FILTER_VALIDATE_IP returning false. This allows an attacker to bypass SSRF protections using DNS rebinding techniques. The issue was addressed and fixed in Lychee version 7.5.2.

The vulnerability allows an attacker with at least low privileges to bypass SSRF protections, potentially causing the server to make unintended requests. However, the CVSS score is low (2.3), indicating limited impact and requiring some privileges to exploit. There are no known exploits in the wild.

Upgrade Lychee to version 7.5.2 or later, where the SSRF vulnerability has been patched. Since this is an open-source product and not a cloud service, users must apply the update themselves. Patch status is confirmed by the vendor's versioning information.