PT-2026-28519

CVE-2026-33738

Published

2026-03-26

Updated

2026-03-26

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Lychee versions prior to 7.5.3

Description Lychee is a free, open-source photo-management tool. Before version 7.5.3, the photo description field was stored without HTML sanitization and rendered using {!! $item->summary !!} (Blade unescaped output) in the RSS, Atom, and JSON feed templates. The /feed API endpoint is publicly accessible without authentication, allowing any RSS reader to execute attacker-controlled JavaScript.

Recommendations Update to version 7.5.3 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Morimori-Dev

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers