Lychee is a free, open-source photo-management application widely used for organizing and sharing images. In versions prior to 7.5.3, the application stores the photo description field without applying HTML sanitization. This field is then rendered using Blade's unescaped output syntax ({!! $item->summary !!}) in the RSS, Atom, and JSON feed templates. The feeds are accessible via the /feed endpoint, which is publicly accessible without requiring user authentication. Because of the lack of input neutralization, an attacker can inject arbitrary JavaScript code into the photo description. When a victim's RSS reader or any client consumes the feed, the malicious script executes in the context of that client, leading to a stored cross-site scripting (XSS) vulnerability categorized under CWE-79. The vulnerability was assigned CVE-2026-33738 and has a CVSS 4.8 (medium) score, reflecting its network accessibility and partial impact on confidentiality and integrity. The issue is resolved in Lychee version 7.5.3 by properly sanitizing the description field before rendering. No public exploits have been reported, but the vulnerability could be leveraged for session hijacking, credential theft, or delivering further malware payloads via client-side execution.

The primary impact of this vulnerability is on the confidentiality and integrity of users consuming the RSS, Atom, or JSON feeds generated by vulnerable Lychee instances. Attackers can execute arbitrary JavaScript in the context of the feed consumer, potentially stealing session cookies, redirecting users to malicious sites, or performing actions on behalf of the user. Since the /feed endpoint is publicly accessible without authentication, any attacker can exploit this without prior access. Organizations using Lychee for photo management and sharing may inadvertently expose their users or subscribers to client-side attacks. Although the vulnerability does not directly affect server availability or integrity, the reputational damage and potential data breaches resulting from successful exploitation can be significant. The scope is limited to users consuming the feeds, but given the public nature of the endpoint, the attack surface is broad. The lack of known exploits in the wild reduces immediate risk but does not eliminate the threat.

The definitive mitigation is to upgrade Lychee to version 7.5.3 or later, where the description field is properly sanitized before rendering in feeds. Until upgrade is possible, administrators should consider disabling or restricting access to the /feed endpoint to trusted users or IP ranges to reduce exposure. Implementing web application firewalls (WAFs) with rules to detect and block suspicious script tags or payloads in feed requests can provide interim protection. Additionally, sanitizing or validating photo descriptions at input time to strip or encode HTML tags can reduce risk. RSS feed consumers should be cautious and use clients that implement script blocking or sandboxing. Monitoring logs for unusual feed access patterns or injection attempts can help detect exploitation attempts. Finally, educating users about the risks of consuming feeds from untrusted sources is advisable.