EUVD-2026-16417Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
Lychee is a free, open-source photo-management tool. Prior to version 7.5.3, the photo description field is stored without HTML sanitization and rendered using {!! $item->summary !!} (Blade unescaped output) in the RSS, Atom, and JSON feed templates. The /feed endpoint is publicly accessible without authentication, allowing any RSS reader to execute attacker-controlled JavaScript. Version 7.5.3 fixes the issue.
AnalysisAI
Stored cross-site scripting (XSS) in Lychee photo-management application versions prior to 7.5.3 allows unauthenticated remote attackers to execute arbitrary JavaScript through unsanitized photo description fields rendered in publicly accessible RSS, Atom, and JSON feed endpoints. The vulnerability stems from use of Blade's unescaped output syntax ({!! !!}) in feed templates, enabling malicious descriptions to inject executable scripts that execute in the context of any RSS reader or client consuming the feed.
Technical ContextAI
Lychee (CPE: cpe:2.3:a:lycheeorg:lychee) is a Laravel-based PHP photo-management application. The vulnerability exists in feed generation templates (RSS, Atom, JSON formats) that render the photo description field using Laravel Blade's triple-brace unescaped output syntax ({!! $item->summary !!}). Unlike standard Blade escaped output ({{ }}), unescaped output bypasses HTML entity encoding, directly rendering user-controlled content. The root cause is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic stored XSS vulnerability where user input (photo descriptions) is stored in the database without sanitization and later output without context-appropriate escaping. The /feed endpoint lacks authentication requirements, making the attack surface public.
RemediationAI
Upgrade Lychee to version 7.5.3 or later immediately (see vendor release at https://github.com/LycheeOrg/Lychee/releases/tag/v7.5.3). The patch, merged in commit d2e2606a0223d5a384d5b806db1b31eb587adc5c and pull request #4218, implements proper HTML sanitization of the description field prior to template rendering. If immediate patching is not feasible, disable public access to the /feed endpoint via reverse proxy or firewall rules, or implement request-level HTML sanitization middleware that strips or encodes potentially malicious tags before feed generation. Additionally, audit existing photo descriptions in the database for stored XSS payloads and sanitize or remove suspicious content.
Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary co
Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain s
Lychee is a free photo-management tool. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Lychee photo management tool versions before 7.1.0 contain an authorization bypass in the album password unlock mechanis
Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in php/Access/Guest.php. Rated medium severit
Incomplete IP validation in Lychee's SSRF protection mechanism allows authenticated users to bypass all four security co
DNS rebinding bypasses SSRF protection in Lychee photo-management tool versions prior to 7.5.2, allowing authenticated r
SQL operator-precedence bug in Lychee prior to 7.5.4 allows authenticated users with upload permission to bypass ownersh
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today