Back to the CVE list

CVE-2026-57569Proof of concept (PoC) published · CISA

Lychee: Distinct post-fix SSRF variant in Photo::fromUrl due to missing IP pinning after DNS-based validation

CVSS score

2.3

EPSS probability

%0.2

Risk score

0.0

Published

4 d ago

Overview Public Exploits (0)Newsroom Vulnerability Timeline

Related Security News

Articles and analysis bulletins in which the press and security publications have covered this vulnerability:

No verified news item has been matched to this CVE yet.

Similar Vulnerabilities

8.3

CVE-2026-77470Lychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST request

VendorLycheeOrg ProductLychee

Patch status unknownEPSS %04 d ago

8.3

CVE-2026-77466Lychee: Webshop payment bypass via unrestricted "Dummy" gateway selection

VendorLycheeOrg ProductLychee

Patch status unknownEPSS %04 d ago

8.2

CVE-2026-61838Lychee: Album password bypass in ZIP downloads

VendorLycheeOrg ProductLychee

Patch status unknownEPSS %04 d ago

8.9

CVE-2026-62679Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read

VendorLycheeOrg ProductLychee

Patch status unknownEPSS %04 d ago

7.5

CVE-2026-61611Lychee: Missing rate limiting on album password unlock endpoint allows brute-force attacks

VendorLycheeOrg ProductLychee

Patch status unknownEPSS %04 d ago

6.9

CVE-2026-77468Lychee: Missing Authentication for Critical Function and Allocation of Resources Without Limits or Throttling on /docs/api

VendorLycheeOrg ProductLychee

Patch status unknownEPSS %04 d ago

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free key Documentation

curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-57569"