CVE-2026-57569

Name of the Vulnerable Software and Affected Versions Lychee versions prior to 7.6.0

Description An authenticated attacker who controls DNS responses can exploit a DNS rebinding time-of-check to time-of-use mismatch. The application validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but subsequently uses the original hostname for a separate fopen connection via app/Actions/Import/FromUrl.php and app/Image/Files/DownloadedFile.php. This allows the attacker to bypass server-side request forgery protections by causing the validation to see a public address while the actual fetch resolves to a private or forbidden address, potentially reaching internal services available to the server.

API Endpoints: 'POST /api/v2/Photo::fromUrl'

Recommendations Update to version 7.6.0.