Lychee stores photo description text without sanitization and directly injects it into the public RSS, Atom, and JSON feeds using unescaped Blade output. This allows an attacker to embed arbitrary JavaScript in a photo’s description. When any RSS reader or script parses the feed, the malicious code runs in the reader’s browser context, potentially stealing session cookies, performing actions on behalf of the user, and compromising confidentiality and integrity of user data. The vulnerability is a stored cross‑site scripting flaw (CWE‑79).

Lychee, the open‑source photo‑management application published by LycheeOrg, is affected. All installations running a version older than 7.5.3 are vulnerable. The issue exists in the `/feed` endpoint that is publicly accessible without authentication.

With a CVSS score of 4.8 the flaw is considered moderate severity. The EPSS score of under 1% suggests that the probability of exploitation is low, and the vulnerability is not flagged in the CISA KEV catalog. The attack path is simple: an attacker submits a photo description containing malicious JavaScript and places the photo in a publicly accessible feed. The stored payload is then served to any RSS reader that pulls the feed; no authentication or special privileges are required. Once the victim’s browser interprets the feed, the injected script can execute with the privileges of the viewer, leading to data theft or other client‑side breaches.