Lychee CVE-2026-57568

Exploitation requires three concrete conditions drawn from the description: (1) the attacker must be an authenticated user holding album-edit permissions, used to store a 'javascript:' URI inside an album or photo Markdown description; (2) the affected version (prior to 7.6.0) must be running with the default config/markdown.php setting allow_unsafe_links=true, which permits the unsafe URI to survive HTML conversion in PreformattedPhotoData.php / PreFormattedAlbumData.php; and (3) a victim must actively click the link as rendered via v-html in the gallery components (PhotoDetails.vue, Overlay.vue, PhotoThumb.vue, AlbumHero.vue, AlbumCard.vue). Limiting factors: the injection step needs an authenticated edit-capable account, and code execution does not occur on page load - it requires the victim's click (UI:A), so passive viewing alone is insufficient. The payoff is broadened because the clicking victim may be an unauthenticated public-album visitor.

This is a stored XSS (CWE-79) with a realistic but not alarming risk profile. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:A) and the 5.7 Medium score align well with the description: the attacker side requires an authenticated account holding album-edit permissions (PR:L), and successful exploitation depends on a victim actively clicking a rendered link (UI:A, AT:P). No EPSS score, KEV listing, or SSVC decision data was provided in the input, and no public exploit was identified - so there is no signal of active or probable exploitation. The GitHub references are a vendor security advisory, the fix PR, the fix commit, and the 7.6.0 release, i.e. patch artifacts rather than weaponized exploit code. The one notable amplification is that while the payload author must be authenticated, the victim can be an unauthenticated visitor to a public album, widening the pool of potential targets even though the injection barrier remains authenticated. The VC:H rating in the vendor vector (full confidentiality impact via session/token theft) is somewhat aggressive for a reflected-on-click XSS; real impact is bounded by what the clicking victim's session can access. Net: a legitimate issue worth patching, not an emergency - closer to a high-CVSS-components-but-moderate-real-risk item, gated by both an authenticated injection step and required user interaction.

An attacker who holds album-edit rights sets a photo or album Markdown description to a 'javascript:' URI, which Lychee renders as a clickable link because allow_unsafe_links is enabled. When any visitor - including an unauthenticated user browsing a public album - clicks that link in the gallery view, attacker-controlled JavaScript runs in the Lychee origin and can read session data or issue requests as the victim. No public exploit code was identified at time of analysis, though the fixing PR and commit are public.