CVE-2026-57569 LycheeOrg CVE debrief

Who should care

Defenders who are responsible for managing and securing Lychee installations should care about this vulnerability, especially if they are using versions prior to 7.6.0. They need to verify exposure and assess the impact of this vulnerability on their systems. The vulnerability requires verification of Lychee versions and potential updates to version 7.6.0 or later. Defenders should also review compensating controls for exposed systems while remediation is

Why it matters

The CVE-2026-57569 vulnerability in Lychee allows an authenticated attacker to bypass SSRF protections and reach services available from the Lychee server, potentially leading to unauthorized access or data breaches.

• An authenticated attacker can bypass SSRF protections and reach services available from the Lychee server.
• The vulnerability can be exploited through a DNS rebinding attack.
• Defenders need to verify exposure and assess the impact of this vulnerability on their systems.
• The vulnerability requires verification of Lychee versions and potential updates to version 7.6.0 or later.

Technical summary

The vulnerability is caused by a missing IP pinning after DNS-based validation in the Photo::fromUrl function of Lychee, a free, open-source photo-management tool. This allows an authenticated attacker to bypass protections and reach services available from the Lychee server. The vulnerability can be exploited through a DNS rebinding attack, potentially leading to unauthorized access or data breaches. The issue is fixed in version 7.6.0. Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially if they are using Lychee versions prior to 7.6.0.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially if they are using Lychee versions prior to 7.6.0.

Recommended defensive actions

• Verify if the system uses Lychee versions prior to 7.6.0 and assess the impact of the vulnerability.
• Update Lychee to version 7.6.0 or later to fix the vulnerability.
• Monitor the system for potential SSRF attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The evidence for this vulnerability comes from the CVE Program record, the NVD vulnerability detail page, and source references from GitHub. The vulnerability is caused by a missing IP pinning after DNS-based validation in the Photo::fromUrl function.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.