CVE-2026-57568: Lychee Photo Management XSS Vulnerability

CVE-2026-57568 Overview

CVE-2026-57568 is a stored Cross-Site Scripting (XSS) vulnerability in Lychee, a free, open-source photo-management application. Versions prior to 7.6.0 allow an authenticated user with album-edit permissions to inject a javascript: URI into an album or photo Markdown description. The rendered gallery views execute attacker-controlled JavaScript when any visitor, including an unauthenticated viewer of a public album, clicks the crafted link. The flaw is tracked under [CWE-79] and is distinct from CVE-2026-33738, which addressed feed rendering.

Critical Impact
Attackers can hijack sessions, exfiltrate authentication data, or issue authenticated requests in the victim's browser context within the Lychee origin.

Affected Products

Lychee photo-management tool versions prior to 7.6.0
Gallery components PhotoDetails.vue, Overlay.vue, PhotoThumb.vue, AlbumHero.vue, and AlbumCard.vue
Markdown rendering pipeline configured via config/markdown.php

Discovery Timeline

2026-10-15 - CVE-2026-57568 published to the National Vulnerability Database (NVD)
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-57568

Vulnerability Analysis

The vulnerability stems from unsafe Markdown rendering across Lychee gallery components. The config/markdown.php configuration file sets allow_unsafe_links to true, which permits the league/commonmark parser to emit javascript: URIs during Markdown-to-HTML conversion. The resource transformers app/Http/Resources/Models/Utils/PreformattedPhotoData.php and app/Http/Resources/Models/Utils/PreFormattedAlbumData.php convert user-supplied descriptions into HTML. The Vue gallery views then render that HTML using the v-html directive, bypassing framework-level sanitization. When a visitor clicks the resulting link, the browser executes JavaScript in the Lychee origin, exposing session cookies and enabling authenticated requests against the application API.

Root Cause

The root cause is an insecure default in the CommonMark Markdown parser configuration combined with trust in server-rendered HTML on the client. Enabling allow_unsafe_links disables the parser's built-in filter that strips dangerous URI schemes. The gallery views compound the issue by using v-html on the resulting markup without client-side sanitization.

Attack Vector

An authenticated user with album or photo edit privileges stores a Markdown description containing a javascript: scheme link. The payload persists in album or photo metadata and is served to every gallery visitor, including unauthenticated users browsing public albums. Exploitation requires a single user click on the rendered link within the vulnerable Lychee origin.

php

	|
	| This option specifies whether to allow risky image URLs and links.
	|
-	| Default: true
+	| Default: false
	|
+	| See: https://commonmark.thephpleague.com/2.x/security/#unsafe-links
	*/

-	'allow_unsafe_links' => true,
+	'allow_unsafe_links' => false,

Source: Lychee GitHub Commit f0604ea

Detection Methods for CVE-2026-57568

Indicators of Compromise

Album or photo description fields containing javascript: URI schemes or encoded variants such as java\\u0073cript:
Markdown link syntax [text](javascript:...) persisted in the Lychee database albums or photos tables
Outbound requests from browsers to attacker-controlled domains following gallery page views

Detection Strategies

Audit stored album and photo description fields for links whose href does not begin with http://, https://, or mailto:
Review Lychee application logs for edit actions performed by accounts shortly before new public album publication
Deploy Content Security Policy (CSP) report-only mode to surface inline script execution attempts within the Lychee origin

Monitoring Recommendations

Monitor the installed Lychee version against the fixed release v7.6.0 and alert on deployments running older builds
Track Markdown rendering output for anchor tags whose href attribute contains script-capable URI schemes
Alert on anomalous session activity, such as credential changes or API calls, originating from gallery page referrers

How to Mitigate CVE-2026-57568

Immediate Actions Required

Upgrade Lychee to version 7.6.0 or later, which sets allow_unsafe_links to false by default
Review and sanitize existing album and photo descriptions for stored javascript: URIs before exposing public galleries
Restrict album-edit permissions to trusted accounts and audit recent permission grants

Patch Information

The fix is delivered in Lychee Release v7.6.0 via Pull Request #4377. The patch changes the default value of allow_unsafe_links in config/markdown.php to false, which instructs the CommonMark parser to strip disallowed URI schemes such as javascript:, vbscript:, file:, and data: from rendered links. Full technical details are available in GitHub Security Advisory GHSA-pgfr-x389-5p2h.

Workarounds

Manually set 'allow_unsafe_links' => false in config/markdown.php and clear the Laravel configuration cache
Deploy a Content Security Policy that forbids inline script execution and restricts script sources to trusted origins
Temporarily disable Markdown descriptions for album and photo entities until the upgrade is applied

bash

# Configuration example - set in config/markdown.php
'allow_unsafe_links' => false,

# Clear cached configuration after editing
php artisan config:clear
php artisan config:cache