CVE-2026-33738

Lychee is a free, open-source photo-management tool. Prior to version 7.5.3, the photo `description` field is stored without HTML sanitization and rendered using `{!! $item->summary !!}` (Blade unescaped output) in the RSS, Atom, and JSON feed templates. The `/feed` endpoint is publicly accessible without authentication, allowing any RSS reader to execute attacker-controlled JavaScript. Version 7.5.3 fixes the issue.

• CWE-79

• https://github.com/LycheeOrg/Lychee/commit/d2e2606a0223d5a384d5b806db1b31eb587adc5cPatch
• https://github.com/LycheeOrg/Lychee/pull/4218Issue Tracking
• https://github.com/LycheeOrg/Lychee/releases/tag/v7.5.3Release Notes
• https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-5574-7f3r-hm9jExploit, Vendor Advisory
• https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-5574-7f3r-hm9jExploit, Vendor Advisory

Published

Mar 26, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33732srvx is a universal server based on web standards. Prior to …6.5
• CVE-2026-33733EspoCRM is an open source customer relationship management a…7.2
• CVE-2026-33734FOSSBilling is a free, open-source billing and client manage…6.9
• CVE-2026-33735MyTube is a self-hosted downloader and player for several vi…8.8
• CVE-2026-33736Chamilo LMS is a learning management system. Prior to 2.0.0-…6.5
• CVE-2026-33737Chamilo LMS is a learning management system. Prior to 1.11.3…6.5
• CVE-2026-33739FOG is a free open-source cloning/imaging/rescue suite/inven…4.8
• CVE-2026-33740EspoCRM is an open source customer relationship management a…5.4
• CVE-2026-33741EspoCRM is an open source customer relationship management a…6.8
• CVE-2026-33742Invoice Ninja is a source-available invoice, quote, project …5.4
• CVE-2026-33743Incus is a system container and virtual machine manager. Pri…6.5
• CVE-2026-33744BentoML is a Python library for building online serving syst…7.8