CVE-2026-57568: Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View)
Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to store a javascript URI in an album or photo Markdown description because config/markdown.php enables allowunsafelinks. app/Http/Resources/Models/Utils/PreformattedPhotoData.php and app/Http/Resources/Models/Utils/PreFormattedAlbumData.php convert the description to HTML, and the gallery components PhotoDetails.vue, Overlay.vue, PhotoThumb.vue, AlbumHero.vue, and AlbumCard.vue render that HTML with v-html. A visitor, including an unauthenticated visitor to a public album, who clicks the rendered link executes attacker-controlled JavaScript in the Lychee origin, which can expose session data or enable authenticated requests in the victim's context. This gallery-view flaw is distinct from CVE-2026-33738, which addressed feed rendering. This issue is fixed in version 7.6.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Lycheeto a version that resolves this vulnerability.Fixed in 7.6.0
Event History
Frequently Asked Questions
Who can introduce the malicious content, and who can be affected by it?
An authenticated Lychee user with album-edit permissions can store a javascript: link in an album or photo Markdown description. Any visitor who clicks that rendered link can be affected, including an unauthenticated visitor viewing a public album.
What user interaction is required for exploitation?
The victim must click the attacker-controlled link rendered in the gallery view. The resulting JavaScript executes in the Lychee origin and can expose session data or make authenticated requests in the victim's context.
Are public albums affected?
Yes. A public album can expose unauthenticated visitors if it contains a malicious photo or album description and the visitor clicks the rendered link.
What version fixes the issue?
Lychee 7.6.0 fixes this issue. Versions prior to 7.6.0 are affected as described.