CVE-2026-57569
Deferred Deferred - Pending Action

Lychee Photo Management DNS Rebinding SSRF Vulnerability

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Actions/Import/FromUrl.php to app/Image/Files/DownloadedFile.php for a separate fopen connection. An authenticated attacker who controls DNS responses can cause validation to observe a public address and the subsequent fetch to resolve the same hostname to a private or otherwise forbidden address. This DNS rebinding time-of-check to time-of-use mismatch bypasses the intended server-side request forgery protections and can reach services available from the Lychee server, subject to deployment and TLS behavior. This issue is fixed in version 7.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-57569
EUVD
EUVD-2026-102188

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
LycheeOrg Lychee < 7.6.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-57569 is a Server-Side Request Forgery (SSRF) vulnerability in Lychee versions 7.5.4 and earlier. It occurs due to a Time-of-Check to Time-of-Use (TOCTOU) flaw in the Photo::fromUrl functionality. During validation, the hostname is checked against SSRF protections, but the subsequent download step uses the original hostname without binding to the validated IP address. This allows an attacker to manipulate DNS responses so the hostname resolves to a benign IP during validation but to a restricted or internal address during the actual download, bypassing SSRF protections.

Detection Guidance

To detect this vulnerability, monitor network traffic for unexpected outbound connections from Lychee, particularly during Photo::fromUrl operations. Check DNS logs for unusual hostname resolutions or rebinding attempts. Inspect Lychee logs for failed or suspicious download attempts from internal or restricted addresses.

Impact Analysis

An authenticated attacker could exploit this vulnerability to access unintended services or bypass localhost/private-address restrictions from the Lychee server. This could lead to unauthorized data access, internal network probing, or interaction with services not intended to be exposed. The impact depends on the deployment environment and TLS behavior.

Compliance Impact

This SSRF vulnerability could potentially allow unauthorized access to internal services or sensitive data, which may violate compliance requirements under GDPR (e.g., unauthorized data access or processing) or HIPAA (e.g., unauthorized access to protected health information). The risk depends on deployment context and whether the exploited service handles regulated data.

Mitigation Strategies

Upgrade Lychee to version 7.6.0 or later immediately. If upgrading is not possible, disable the Photo::fromUrl functionality or restrict network access to Lychee to prevent unauthorized outbound connections. Implement network-level SSRF protections like IP pinning or DNS filtering.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57569. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart