Server-Side Request Forgery Vulnerability in Lychee Photo Management Tool

CVE-2025-53018

What is CVE-2025-53018?

The Lychee photo management tool is susceptible to a Server-Side Request Forgery (SSRF) vulnerability that allows attackers to manipulate the application’s backend via an unprotected API endpoint. This flaw enables unauthorized HTTP requests to be made to any URL specified by the attacker, potentially exposing internal network resources including localhost services and sensitive cloud metadata. The vulnerability arises from the lack of validation on user-provided URLs, as the system uses fopen() without requisite security measures. As a result, intruders can exploit this issue to conduct internal port scanning or access sensitive data. Affected users are urged to upgrade to version 6.6.13, which includes a fix for this significant security risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References