Lychee, a popular open‑source photo‑management application, stores the photo description field without sanitization. When the public /feed endpoint renders these descriptions using unescaped Blade output, any attacker‑supplied JavaScript is stored and later served to a reader consuming the RSS, Atom, or JSON feed. The resulting stored cross‑site scripting allows code execution in the context of the recipient’s client, potentially enabling credential theft, defacement, or other client‑side attacks.

The vulnerability applies to all Lychee installations older than version 7.5.3. The vendor released a fix in 7.5.3, and later releases are considered secure.

The CVSS score of 4.8 indicates a moderate risk. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, implying limited known exploitation. Because the /feed endpoint is publicly accessible without authentication, an attacker can target any subscriber to the feed, but the impact is confined to the client side of the feed consumer.