CVE WATCH / VULNERABILITY DETAIL
CVE-2026-57569
UNKNOWNCVSS 0NVD feed
Published 15 October 2026 · tracked since 16 October 2026
Description
Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Actions/Import/FromUrl.php to app/Image/Files/DownloadedFile.php
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-111138 MEDIUM 5.5
- CVE-2026-110874 MEDIUM 6.6
- CVE-2026-110878 MEDIUM 5.4
- CVE-2026-109924 MEDIUM 5.9
- CVE-2026-109932 MEDIUM 5.9
- CVE-2026-109829 HIGH 7.4
- CVE-2026-109841 MEDIUM 5.9
- CVE-2026-109869 HIGH 7.5
- CVE-2026-109383 HIGH 7.4
- CVE-2026-104150