CVE-2026-57568: Lychee < 7.6.0

Affected technology

Lychee · < 7.6.0
LycheeOrg

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · Active user interaction

What an attacker can do

An authenticated user with album-edit permissions can store a javascript URI in an album or photo Markdown description because config/markdown.php enables allow_unsafe_links. app/Http/Resources/Models/Utils/PreformattedPhotoData.php and app/Http/Resources/Models/Utils/PreFormattedAlbumData.php convert the description to HTML, and the gallery components PhotoDetails.vue, Overlay.vue, PhotoThumb.vue, AlbumHero.vue, and AlbumCard.vue render that HTML with v-html. Vendor/CNA’s CVSS 4.0 assessment (base score 5.7/10) rates confidentiality impact as high; integrity and availability impact as none.