CVE-2026-57569: Lychee: Distinct post-fix SSRF variant in Photo::fromUrl due to missing IP pinning after DNS-based validation
Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Actions/Import/FromUrl.php to app/Image/Files/DownloadedFile.php for a separate fopen connection. An authenticated attacker who controls DNS responses can cause validation to observe a public address and the subsequent fetch to resolve the same hostname to a private or otherwise forbidden address. This DNS rebinding time-of-check to time-of-use mismatch bypasses the intended server-side request forgery protections and can reach services available from the Lychee server, subject to deployment and TLS behavior. This issue is fixed in version 7.6.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Lycheeto a version that resolves this vulnerability.Fixed in 7.6.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and able to control DNS responses for a hostname used with the POST /api/v2/Photo::fromUrl endpoint. Exploitation also depends on the Lychee server being able to reach the target service and on the deployment's TLS behavior.
Which deployments are affected?
Lychee versions prior to 7.6.0 are affected where authenticated users can use Photo::fromUrl. The issue can expose private or otherwise forbidden network services reachable from the Lychee server.
What is the remediation?
Upgrade Lychee to version 7.6.0, which fixes the issue.