Photo-management Tool Lychee Exposed to DNS Rebinding Vulnerability

CVE-2026-57569

What is CVE-2026-57569?

Lychee, an open-source photo-management tool, contains a vulnerability that affects versions before 7.6.0. The issue lies in the validation of hostnames in the API's photo import functionality. An authenticated attacker can manipulate DNS responses, leading to a scenario where the intended hostname validation is bypassed. This allows the attacker to redirect the request to unprotected internal services, potentially compromising sensitive data accessible from the Lychee server. This flaw has been addressed in version 7.6.0, and users are advised to upgrade to this version or later to ensure their systems' safety.

References