Unrated severityNVD Advisory· Published Mar 26, 2026· Updated Mar 27, 2026
Lychee Vulnerable to Stored XSS via Photo Description in RSS/Atom/JSON Feed (No Sanitization on Public Endpoint)
CVE-2026-33738
Description
Lychee is a free, open-source photo-management tool. Prior to version 7.5.3, the photo description field is stored without HTML sanitization and rendered using {!! $item->summary !!} (Blade unescaped output) in the RSS, Atom, and JSON feed templates. The /feed endpoint is publicly accessible without authentication, allowing any RSS reader to execute attacker-controlled JavaScript. Version 7.5.3 fixes the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
4- github.com/LycheeOrg/Lychee/commit/d2e2606a0223d5a384d5b806db1b31eb587adc5cmitrex_refsource_MISC
- github.com/LycheeOrg/Lychee/pull/4218mitrex_refsource_MISC
- github.com/LycheeOrg/Lychee/releases/tag/v7.5.3mitrex_refsource_MISC
- github.com/LycheeOrg/Lychee/security/advisories/GHSA-5574-7f3r-hm9jmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.