{"id":"CVE-2026-57569","title":"Lychee is a free, open-source photo-management tool","summary":"Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Ac…","severity":"low","cvss":2.3,"cvssVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:L","cwe":["CWE-367","CWE-918"],"vendor":"LycheeOrg","product":"Lychee","affected":["Lychee < 7.6.0"],"published":"2026-10-15","updated":"2026-10-15","sourceUpdated":"2026-10-15T18:17:28.463","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57569","references":[{"url":"https://github.com/LycheeOrg/Lychee/commit/a5f23e314f1a933d31aa650616bf9cd84bd0407e","label":"security-advisories@github.com"},{"url":"https://github.com/LycheeOrg/Lychee/pull/4344","label":"security-advisories@github.com"},{"url":"https://github.com/LycheeOrg/Lychee/releases/tag/v7.6.0","label":"security-advisories@github.com"},{"url":"https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-vj35-v9x5-vrxh","label":"security-advisories@github.com"},{"url":"https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-vj35-v9x5-vrxh","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-15T17:57:45.409797Z"},"cvssSource":"cna","ingestedAt":"2026-10-15T17:18:20.098Z","slug":"CVE-2026-57569","body":"## Overview\n\nLychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Actions/Import/FromUrl.php to app/Image/Files/DownloadedFile.php for a separate fopen connection. An authenticated attacker who controls DNS responses can cause validation to observe a public address and the subsequent fetch to resolve the same hostname to a private or otherwise forbidden address. This DNS rebinding time-of-check to time-of-use mismatch bypasses the intended server-side request forgery protections and can reach services available from the Lychee server, subject to deployment and TLS behavior. This issue is fixed in version 7.6.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":25,"depthScoreParts":{"impact":12.6,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":222641,"id":"CVE-2026-57569","ts":1792088715371,"field":"exploit_available","old":"false","new":"true"}]}