Quick answers
- Is CVE-2026-57568 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-57568 being exploited in the wild.
- How severe is CVE-2026-57568?
- Informational severity, published 15 October 2026.
- Which products and versions are affected?
- LycheeOrg Lychee prior to 7.6.0.
- Is there a fix for CVE-2026-57568?
- Yes: fixed in 7.6.0. Until then: Disable album-edit permissions for untrusted users until upgrading to version 7.6.0, or restrict public album access. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-57568 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-57568?
- Check whether you run LycheeOrg Lychee at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 7.6.0
Disable album-edit permissions for untrusted users until upgrading to version 7.6.0, or restrict public album access.
Technical details
A stored XSS vulnerability exists because the Markdown parser configuration (config/markdown.php) allows unsafe links via the allow_unsafe_links setting, and Vue components (PhotoDetails.vue, Overlay.vue, PhotoThumb.vue, AlbumHero.vue, AlbumCard.vue) render the converted HTML descriptions with v-html without sanitization. An authenticated attacker with album-edit permissions can craft a javascript: URI in a Markdown description; when a visitor clicks it, the attacker's script executes in the victim's browser context. This attack requires authentication to inject the payload but affects any viewer including unauthenticated users of public albums.
Affected products
- LycheeOrg Lychee prior to 7.6.0
Timeline
- 2026-10-15: disclosed
- 2026-05-26: patched