Server-Side Request Forgery Vulnerability in Lychee Photo Management Tool
CVE-2025-53018

3LOW

Key Information:

Vendor

Lycheeorg

Status
Lychee
Vendor
CVE Published:
27 June 2025

What is CVE-2025-53018?

The Lychee photo management tool is susceptible to a Server-Side Request Forgery (SSRF) vulnerability that allows attackers to manipulate the application’s backend via an unprotected API endpoint. This flaw enables unauthorized HTTP requests to be made to any URL specified by the attacker, potentially exposing internal network resources including localhost services and sensitive cloud metadata. The vulnerability arises from the lack of validation on user-provided URLs, as the system uses fopen() without requisite security measures. As a result, intruders can exploit this issue to conduct internal port scanning or access sensitive data. Affected users are urged to upgrade to version 6.6.13, which includes a fix for this significant security risk.

Affected Version(s)

Lychee < 6.6.13

References

https://github.com/LycheeOrg/Lychee/security/advisories/G...
x_refsource_CONFIRM
https://github.com/LycheeOrg/Lychee/commit/9dc162eefe56ce...
x_refsource_MISC

CVSS V3.1

Score:
3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.