CVE-2026-33738 Details
Description
Lychee is a free, open-source photo-management tool. Prior to version 7.5.3, the photo `description` field is stored without HTML sanitization and rendered using `{!! $item->summary !!}` (Blade unescaped output) in the RSS, Atom, and JSON feed templates. The `/feed` endpoint is publicly accessible without authentication, allowing any RSS reader to execute attacker-controlled JavaScript. Version 7.5.3 fixes the issue.
A stored cross-site scripting vulnerability has been identified in Lychee, a photo management tool, in versions prior to 7.5.3. The issue arises because the photo description field is saved without proper HTML sanitization. This unsanitized content is then rendered as unescaped HTML in the RSS, Atom, and JSON feed templates. The vulnerability is exposed through the publicly accessible /feed endpoint, which does not require authentication, allowing any RSS reader to execute JavaScript controlled by an attacker.
Users can update to Lychee version 7.5.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-5574-7f3r-hm9j | CISA-ADP | ExploitVendor Advisory |
| https://github.com/LycheeOrg/Lychee/commit/d2e2606a0223d5a384d5b806db1b31eb587adc5c | [email protected] | Patch |
| https://github.com/LycheeOrg/Lychee/pull/4218 | [email protected] | Issue Tracking |
| https://github.com/LycheeOrg/Lychee/releases/tag/v7.5.3 | [email protected] | Release Notes |
| https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-5574-7f3r-hm9j | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| lycheeorg lychee | < 7.5.3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 30, 2026 | Initial Analysis | [email protected] |
| Mar 27, 2026 | CVE Modified | CISA-ADP |
| Mar 26, 2026 | New CVE Received | [email protected] |