CVE-2026-57568: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in LycheeOrg Lychee

Lychee versions before 7.6.0 permit authenticated users with album-edit permissions to store JavaScript URIs in album or photo Markdown descriptions because the configuration enables allow_unsafe_links. The description content is converted to HTML and rendered using Vue's v-html directive in several gallery components. When a visitor clicks the rendered link, attacker-controlled JavaScript executes in the context of the Lychee origin, potentially exposing session data or enabling authenticated requests. This vulnerability is distinct from CVE-2026-33738, which addressed feed rendering. The vulnerability is resolved in Lychee version 7.6.0.

An attacker with album-edit permissions can inject malicious JavaScript that executes in the browser of any visitor who clicks the crafted link, including unauthenticated visitors to public albums. This can lead to exposure of session data or unauthorized actions performed with the victim's privileges within the Lychee application context. The CVSS 4.0 score is 5.7 (medium severity), reflecting network attack vector, low attack complexity, partial attacker's privileges, and high impact on confidentiality.

Upgrade Lychee to version 7.6.0 or later where this vulnerability is fixed. The fix removes the unsafe allowance of JavaScript URIs in Markdown descriptions and prevents execution of attacker-controlled scripts in rendered HTML. No other mitigation is required as the issue is resolved in the official release.