CVE-2026-57568

Name of the Vulnerable Software and Affected Versions Lychee versions prior to 7.6.0

Description An authenticated user with album-edit permissions can store a javascript URI within an album or photo Markdown description. This occurs because the allow unsafe links setting in config/markdown.php is enabled. The files app/Http/Resources/Models/Utils/PreformattedPhotoData.php and app/Http/Resources/Models/Utils/PreFormattedAlbumData.php convert these descriptions to HTML, which are then rendered using v-html in the gallery components PhotoDetails.vue, Overlay.vue, PhotoThumb.vue, AlbumHero.vue, and AlbumCard.vue. A visitor, including unauthenticated users viewing public albums, who clicks the rendered link will execute attacker-controlled JavaScript in the Lychee origin, potentially exposing session data or enabling authenticated requests in the victim's context.

Recommendations Update to version 7.6.0.