CVE-2026-57568

Deferred Deferred - Pending Action

Stored XSS in Lychee Photo Management Tool

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to store a javascript URI in an album or photo Markdown description because config/markdown.php enables allow_unsafe_links. app/Http/Resources/Models/Utils/PreformattedPhotoData.php and app/Http/Resources/Models/Utils/PreFormattedAlbumData.php convert the description to HTML, and the gallery components PhotoDetails.vue, Overlay.vue, PhotoThumb.vue, AlbumHero.vue, and AlbumCard.vue render that HTML with v-html. A visitor, including an unauthenticated visitor to a public album, who clicks the rendered link executes attacker-controlled JavaScript in the Lychee origin, which can expose session data or enable authenticated requests in the victim's context. This gallery-view flaw is distinct from CVE-2026-33738, which addressed feed rendering. This issue is fixed in version 7.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-57568

EUVD

EUVD-2026-102187

Affected Vendors & Products

Vendor	Product	Version / Range
LycheeOrg	Lychee	< 7.6.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

CVE-2026-57568 is a stored cross-site scripting (XSS) vulnerability in Lychee, a photo management tool. It allows an authenticated user with album-edit permissions to embed malicious JavaScript URIs in album or photo descriptions via Markdown. The application converts these descriptions to HTML without proper sanitization, and gallery components render the HTML using v-html, executing attacker-controlled scripts when links are clicked.

Detection Guidance

Check Lychee version with: grep -r "version" /path/to/lychee/config/app.php. If version is below 7.6.0, the system is vulnerable. Inspect markdown configuration in config/markdown.php for allow_unsafe_links set to true. Review album or photo descriptions for javascript: URIs in Markdown links.

Impact Analysis

An attacker could steal session tokens, forge authenticated requests, or redirect users to malicious sites. Both authenticated and unauthenticated users viewing public albums are affected. The impact includes potential data theft, account compromise, or unauthorized actions performed on behalf of the victim.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, such as session tokens or user information, due to the execution of malicious JavaScript in the Lychee origin. This may violate GDPR's data protection principles if personal data is exposed, and HIPAA's security requirements if protected health information is compromised.

Mitigation Strategies

Upgrade Lychee to version 7.6.0 or later immediately. Set allow_unsafe_links to false in config/markdown.php. Review and remove any existing javascript: URIs in album or photo descriptions. Monitor for suspicious activity in logs.

Hi! I’m here to help you understand CVE-2026-57568. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70