CVE-2026-57569 | LycheeOrg Lychee up to 7.5.x Import PhotoUrlRule.php Photo::fromUrl dns rebinding

October 15, 2026 Yanac

A vulnerability described as critical has been identified in LycheeOrg Lychee up to 7.5.x. This impacts the function Photo::fromUrl of the file app/Rules/PhotoUrlRule.php of the component Import. The manipulation results in reliance on reverse dns resolution.

This vulnerability is identified as CVE-2026-57569. The attack can be executed remotely. There is not any exploit available.

Upgrading the affected component is recommended.VulDB Recent EntriesRead More