CVE-2026-57569 Details
Description
Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Actions/Import/FromUrl.php to app/Image/Files/DownloadedFile.php for a separate fopen connection. An authenticated attacker who controls DNS responses can cause validation to observe a public address and the subsequent fetch to resolve the same hostname to a private or otherwise forbidden address. This DNS rebinding time-of-check to time-of-use mismatch bypasses the intended server-side request forgery protections and can reach services available from the Lychee server, subject to deployment and TLS behavior. This issue is fixed in version 7.6.0.
A vulnerability in Lychee photo management tool versions prior to 7.6.0 allows for server-side request forgery (SSRF) attacks via the Photo::fromUrl function. The issue arises from a time-of-check to time-of-use (TOCTOU) vulnerability, where an authenticated attacker can manipulate DNS responses. The validation process can be tricked into accepting a public IP address, while the actual fetch operation resolves to a private or forbidden address. This bypasses the application's intended protections and could potentially access restricted services, depending on the server's deployment and TLS settings.
Users can update to Lychee version 7.6.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-vj35-v9x5-vrxh | CISA-ADP | AdvisoryTechnical DescriptionVendor |
| https://github.com/LycheeOrg/Lychee/commit/a5f23e314f1a933d31aa650616bf9cd84bd0407e | [email protected] | Source CodeVendor |
| https://github.com/LycheeOrg/Lychee/pull/4344 | [email protected] | Source CodeVendor |
| https://github.com/LycheeOrg/Lychee/releases/tag/v7.6.0 | [email protected] | Release NotesVendor |
| https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-vj35-v9x5-vrxh | [email protected] | AdvisoryTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Lychee | <= 7.5.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |