---
id: CVE-2026-57569
title: 'Lychee is a free, open-source photo-management tool'
summary: >-
  Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST
  /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in
  app/Rules/PhotoUrlRule.php but later passes the original hostname through
  app/Ac…
severity: low
cvss: 2.3
cvssVector: 'CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:L'
cwe:
  - CWE-367
  - CWE-918
vendor: LycheeOrg
product: Lychee
affected:
  - Lychee < 7.6.0
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T18:17:28.463'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-57569'
references:
  - url: >-
      https://github.com/LycheeOrg/Lychee/commit/a5f23e314f1a933d31aa650616bf9cd84bd0407e
    label: security-advisories@github.com
  - url: 'https://github.com/LycheeOrg/Lychee/pull/4344'
    label: security-advisories@github.com
  - url: 'https://github.com/LycheeOrg/Lychee/releases/tag/v7.6.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-vj35-v9x5-vrxh
    label: security-advisories@github.com
  - url: >-
      https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-vj35-v9x5-vrxh
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-15T17:57:45.409797Z'
cvssSource: cna
ingestedAt: '2026-10-15T17:18:20.098Z'
---

## Overview

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Actions/Import/FromUrl.php to app/Image/Files/DownloadedFile.php for a separate fopen connection. An authenticated attacker who controls DNS responses can cause validation to observe a public address and the subsequent fetch to resolve the same hostname to a private or otherwise forbidden address. This DNS rebinding time-of-check to time-of-use mismatch bypasses the intended server-side request forgery protections and can reach services available from the Lychee server, subject to deployment and TLS behavior. This issue is fixed in version 7.6.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.