CVE-2026-57568 in Lychee
Summary
by MITRE • 10/15/2026
Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to store a javascript URI in an album or photo Markdown description because config/markdown.php enables allow_unsafe_links. app/Http/Resources/Models/Utils/PreformattedPhotoData.php and app/Http/Resources/Models/Utils/PreFormattedAlbumData.php convert the description to HTML, and the gallery components PhotoDetails.vue, Overlay.vue, PhotoThumb.vue, AlbumHero.vue, and AlbumCard.vue render that HTML with v-html. A visitor, including an unauthenticated visitor to a public album, who clicks the rendered link executes attacker-controlled JavaScript in the Lychee origin, which can expose session data or enable authenticated requests in the victim's context. This gallery-view flaw is distinct from CVE-2026-33738, which addressed feed rendering. This issue is fixed in version 7.6.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
Lychee is a widely used free and open-source photo-management application that allows users to organize, store, and share images through web-based galleries. A significant security vulnerability was identified in versions prior to 7.6.0 involving the handling of Markdown descriptions within albums and photos. The core issue stems from the configuration file config/markdown.php, which enables the allow_unsafe_links option by default or when explicitly set. This setting permits the inclusion of javascript: URIs within Markdown text during content creation. While this feature is intended to support rich formatting, it creates a critical pathway for Cross-Site Scripting attacks because the application fails to adequately sanitize these dangerous URI schemes before rendering them in the browser context.
The technical flaw manifests through the application's data processing and rendering pipeline. When an authenticated user with album-edit permissions provides input containing a javascript: URI within a Markdown description, the system processes this content using specific PHP classes located at app/Http/Resources/Models/Utils/PreformattedPhotoData.php and app/Http/Resources/Models/Utils/PreFormattedAlbumData.php. These components convert the Markdown text into HTML format without stripping or escaping the malicious JavaScript protocol. Subsequently, various Vue.js frontend components, including PhotoDetails.vue, Overlay.vue, PhotoThumb.vue, AlbumHero.vue, and AlbumCard.vue, utilize the v-html directive to render this untrusted HTML directly within the DOM. The use of v-html bypasses standard template sanitization mechanisms, allowing any embedded script tags or event handlers contained within the parsed content to execute as native JavaScript code in the context of the Lychee application domain.
The operational impact of this vulnerability is severe because it affects not only authenticated users but also unauthenticated visitors viewing public albums. An attacker who has obtained album-edit permissions can inject a malicious link disguised as normal text or an image description. When any user, including those without login credentials, views the affected album and interacts with the rendered content by clicking the crafted element, the browser executes the injected JavaScript payload. This execution occurs within the origin of the Lychee instance, granting the attacker full access to the application's client-side environment. Consequently, attackers can steal sensitive session cookies, hijack user sessions, perform actions on behalf of victims such as modifying or deleting photos and albums, and potentially escalate privileges if combined with other vulnerabilities. This flaw is distinct from CVE-2026-33738, which addressed similar issues in feed rendering but did not cover the gallery view components where this specific vector operates.
From a classification perspective, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting (XSS). Specifically, it represents an Stored XSS scenario because the malicious payload is saved in the database via the Markdown description and later retrieved and executed. In terms of adversary tactics, this aligns with MITRE ATT&CK technique T1059: Command and Scripting Interpreter, particularly JavaScript execution within a browser environment to achieve initial access or persistence through session hijacking. The vulnerability highlights the risks associated with allowing unsafe links in rich text editors when those texts are rendered via innerHTML-like mechanisms without rigorous sanitization libraries such as DOMPurify.
To mitigate this risk, organizations running Lychee must upgrade immediately to version 7.6.0 or later, where the developers have addressed the parsing and rendering logic to prevent javascript: URIs from being executed in the gallery view. For environments that cannot yet patch, administrators should disable the allow_unsafe_links option in config/markdown.php if possible, although this may restrict legitimate functionality. Additionally, implementing a Content Security Policy (CSP) with strict script-src directives can help mitigate the impact by preventing inline scripts and javascript: URIs from executing even if they are injected into the DOM. Regular security audits of Markdown processing pipelines and ensuring that all user-supplied content is sanitized before being passed to v-html or similar rendering methods are essential best practices for maintaining web application integrity.