CVE-2026-33738: Lychee Vulnerable to Stored XSS via Photo Description in RSS/Atom/JSON Feed (No Sanitization on Public Endpoint)
Lychee is a free, open-source photo-management tool. Prior to version 7.5.3, the photo description field is stored without HTML sanitization and rendered using {!! $item->summary !!} (Blade unescaped output) in the RSS, Atom, and JSON feed templates. The /feed endpoint is publicly accessible without authentication, allowing any RSS reader to execute attacker-controlled JavaScript. Version 7.5.3 fixes the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33738?
CVE-2026-33738 has been classified with a moderate severity level due to potential stored XSS risks.
How do I fix CVE-2026-33738?
To fix CVE-2026-33738, upgrade your Lychee installation to version 7.5.3 or later, where the issue has been addressed.
What is the primary risk associated with CVE-2026-33738?
The primary risk of CVE-2026-33738 is that an attacker could exploit stored XSS vulnerabilities to execute malicious scripts on users' browsers.
Which versions of Lychee are affected by CVE-2026-33738?
Versions of Lychee prior to 7.5.3 are affected by CVE-2026-33738, as they lack HTML sanitization for photo descriptions.
Is there a public exploit for CVE-2026-33738?
As of now, public exploits for CVE-2026-33738 have not been widely reported, but the vulnerability remains a serious concern until patched.