CVE-2025-53018

Lychee is a free, open-source photo-management tool. Prior to version 6.6.13, a critical Server-Side Request Forgery (SSRF) vulnerability exists in the `/api/v2/Photo::fromUrl` endpoint. This flaw lets an attacker instruct the application’s backend to make HTTP requests to any URL they choose. Consequently, internal network resources—such as localhost services or cloud-provider metadata endpoints—become reachable. The endpoint takes a URL from the user and calls it server-side via fopen() without any safeguards. There is no IP address validation, nor are there any allow-list, timeout, or size restrictions. Because of this, attackers can point the application at internal targets. Using this flaw, an attacker can perform internal port scans or retrieve sensitive cloud metadata. Version 6.6.13 contains a patch for the issue.

• CWE-918

• https://github.com/LycheeOrg/Lychee/commit/9dc162eefe56ce185ac1d59da42ee557933d914d
• https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-cpgw-wgf3-xc6v
• https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-cpgw-wgf3-xc6v

Published

Jun 27, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-53011MaterialX is an open standard for the exchange of rich mater…7.5
• CVE-2025-53012MaterialX is an open standard for the exchange of rich mater…7.5
• CVE-2025-53013Himmelblau is an interoperability suite for Microsoft Azure …5.2
• CVE-2025-53014ImageMagick is free and open-source software used for editin…9.8
• CVE-2025-53015ImageMagick is free and open-source software used for editin…7.5
• CVE-2025-53017Rejected reason: Reason: This candidate was issued in error.
• CVE-2025-53019ImageMagick is free and open-source software used for editin…7.5
• CVE-2025-5302A denial of service vulnerability exists in the JSONReader c…8.6
• CVE-2025-53020Late Release of Memory after Effective Lifetime vulnerabilit…7.5
• CVE-2025-53021A session fixation vulnerability in Moodle 3.x through 3.11.…4.2
• CVE-2025-53022TrustedFirmware-M (aka Trusted Firmware for M profile Arm CP…8.6
• CVE-2025-53023Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9