CVE-2024-25807 Overview
CVE-2024-25807 is a stored Cross-Site Scripting (XSS) vulnerability in Lychee 3.1.6, an open-source photo-management application maintained by the Lychee project. Remote attackers can inject arbitrary JavaScript through the title parameter when creating an album. The application fails to sanitize or encode the album title before rendering it in the web interface. When another user views the affected album, the injected script executes in the victim's browser context.
Successful exploitation allows attackers to steal session cookies, capture sensitive information, or perform actions on behalf of authenticated users. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.
Critical Impact
Attackers can execute arbitrary JavaScript in victim browsers and obtain sensitive information by injecting a malicious payload into an album title.
Affected Products
- Lycheeorg Lychee version 3.1.6
- CPE: cpe:2.3:a:lycheeorg:lychee:3.1.6
- Self-hosted Lychee installations exposing album creation to untrusted users
Discovery Timeline
- 2024-03-22 - CVE-2024-25807 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-25807
Vulnerability Analysis
The vulnerability resides in the album creation workflow of Lychee 3.1.6. When a user submits a new album, the application accepts the title parameter without applying context-aware output encoding. The stored title is later rendered directly into HTML pages that list or display albums.
Because the payload persists in the backend datastore, every subsequent page load that renders the album triggers the injected script. This makes the flaw a stored (persistent) XSS, which is more impactful than reflected variants. Any authenticated user viewing the malicious album, including administrators, executes the attacker-controlled JavaScript in their browser session.
Root Cause
The root cause is missing input sanitization and output encoding on the title field of the album creation endpoint. The application treats user-supplied text as trusted markup during template rendering. Standard defenses such as HTML entity encoding or a strict Content Security Policy (CSP) are not applied to this field in the affected release.
Attack Vector
Exploitation requires network access to a Lychee 3.1.6 instance and the ability to create an album. Attackers craft an album title containing an HTML or JavaScript payload, submit it through the album creation form or API, and wait for another user to browse the affected view. User interaction is required, since the victim must load a page that renders the malicious title.
Once triggered, the payload can exfiltrate session tokens, alter DOM content, or issue authenticated requests against the Lychee backend on behalf of the victim. Public details are available in the GitHub CVE Issue #17.
Detection Methods for CVE-2024-25807
Indicators of Compromise
- Album records whose title field contains HTML tags such as <script>, <img onerror=...>, or <svg onload=...>.
- Outbound HTTP requests from user browsers to unfamiliar domains shortly after loading Lychee album pages.
- Unexpected session activity or credential reuse originating from administrator accounts that browsed shared albums.
Detection Strategies
- Perform database queries against the Lychee albums table to identify entries containing angle brackets, javascript: URIs, or event-handler attributes in title fields.
- Inspect web server access logs for POST requests to the album creation endpoint with URL-encoded script payloads in the title parameter.
- Deploy a Web Application Firewall (WAF) signature that flags XSS payload patterns targeting Lychee endpoints.
Monitoring Recommendations
- Enable verbose application logging on Lychee to capture request bodies for album create and update operations.
- Forward web server, WAF, and browser CSP violation reports to a centralized logging platform for correlation.
- Alert on any Lychee administrator session that immediately follows a viewing of a newly created album from an untrusted account.
How to Mitigate CVE-2024-25807
Immediate Actions Required
- Upgrade Lychee to a current, supported release beyond the 3.x branch that includes output encoding fixes for album metadata.
- Restrict album creation to trusted, authenticated users and disable public or anonymous album submission.
- Audit existing albums for suspicious title values and remove any entries containing HTML or JavaScript markup.
Patch Information
No vendor advisory URL is listed in the enriched data for this CVE. Administrators should track fixes through the Lychee project on GitHub and apply the latest stable release. Version 3.1.6 remains vulnerable and should not be deployed in production environments.
Workarounds
- Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
- Place Lychee behind a WAF configured with XSS payload detection rules for the album creation endpoint.
- Limit account creation and album creation permissions to internal users until the instance is upgraded.
# Example restrictive Content Security Policy header for the Lychee virtual host
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
