Immich CVE-2026-105764

Requires an authenticated non-admin account on the Immich instance (PR:L) with the ability to upload assets. Exploitation depends on crafting an SVG that bypasses libvips' native SVG loader so that processing falls through to ImageMagick, where attacker-controlled <image href> values reach ImageMagick's unrestricted MSL and VIDEO coder operations. The attack specifically requires storing one crafted asset and then referencing its path from a second 'delayed-marker' SVG, and is only triggered when server-side thumbnail generation runs over the malicious file. Limiting factors: the multi-step crafted-file chain (reflected as AC:H and the AT:P attack requirement), the need for a valid account, and dependence on an ImageMagick fallback with MSL/VIDEO coders reachable; instances running version 3.2.4 or later are not affected.

This is a genuine high-priority issue for exposed Immich instances but with meaningful preconditions. The provided CVSS 4.0 vector (7.7 High) shows a network vector (AV:N) with no user interaction (UI:N) and only low privileges required (PR:L), meaning any authenticated non-admin account can reach the vulnerable thumbnail path - a low bar on multi-user instances or those with self-registration enabled. Impact is full RCE in the immich-server container (VC:H/VI:H/VA:H, CWE-94), which is severe. Tempering this, the vector carries AC:H and AT:P: exploitation is non-trivial, requiring a crafted SVG that bypasses the libvips native loader and falls through to ImageMagick's MSL/VIDEO coders, plus a two-asset 'delayed-marker' technique. No EPSS score was provided, the CVE is not in CISA KEV (no active-exploitation signal), and no public PoC is indicated - so this is high-impact but not currently a mass-exploitation event. Subsequent-system impact is None (SC:N/SI:N/SA:N), so the blast radius is the container itself rather than an automatic pivot. Net: prioritize patching for any internet-reachable or multi-tenant Immich deployment, but note that exploitation complexity and the authentication requirement make opportunistic mass exploitation less likely than a targeted attack by a user who already holds an account.

An attacker with an ordinary (non-admin) Immich account uploads a crafted SVG whose <image href> references a second previously-stored asset, abusing the fact that files rejected by libvips' native SVG loader fall through to ImageMagick's unrestricted MSL and VIDEO coders. When the server's thumbnail-generation code processes the delayed-marker SVG, the attacker-controlled coder operations execute code inside the immich-server container. No public exploit is identified at time of analysis, and the AC:H/AT:P metrics indicate the crafted-file chain is non-trivial to construct.