What is the CVSS score of CVE-2026-35455?

CVE-2026-35455 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Immich are affected by CVE-2026-35455?

Immich photo management platform versions before 2.7.0 contain a stored cross-site scripting vulnerability that allows authenticated users to inject malicious code through 360° panorama images with…. A patch is available.

How to fix or mitigate CVE-2026-35455?

Within 24 hours: inventory all Immich deployments and document current versions; confirm OCR + panorama viewer features are in use. Within 7 days: upgrade all instances to Immich 2.7.0 or later per vendor advisory; test core functionality post-upgrade. Within 30 days: audit Immich access logs for suspicious 360° image uploads or OCR activity during vulnerability window; review shared galleries for unusual content; reset API keys for users with access to sensitive photo collections.

Immich CVE-2026-35455

EUVD-2026-20583 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-08 GitHub_M

XSS Immich Immich App

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jul 24, 2026 - 21:22 NVD

HIGH MEDIUM

CVSS changed

Jul 24, 2026 - 21:22 NVD

7.3 (HIGH) 5.4 (MEDIUM)

Analysis Updated

Apr 16, 2026 - 06:01 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.7.0

EUVD ID Assigned

Apr 08, 2026 - 19:31 euvd

EUVD-2026-20583

Analysis Generated

Apr 08, 2026 - 19:31 vuln.today

CVE Published

Apr 08, 2026 - 18:31 nvd

HIGH 7.3

DescriptionNVD

immich is a high performance self-hosted photo and video management solution. Prior to 2.7.0, sStored Cross-Site Scripting (XSS) in the 360° panorama viewer allows any authenticated user to execute arbitrary JavaScript in the browser of any other user who views the malicious panorama with the OCR overlay enabled. The attacker uploads an equirectangular image containing crafted text; OCR extracts it, and the panorama viewer renders it via innerHTML without sanitization. This enables session hijacking (via persistent API key creation), private photo exfiltration, and access to GPS location history and face biometric data. This vulnerability is fixed in 2.7.0.

AnalysisAI

Stored Cross-Site Scripting in Immich photo management platform versions prior to 2.7.0 enables authenticated attackers to execute arbitrary JavaScript when victims view malicious 360° panorama images with OCR overlay enabled. Attackers upload specially crafted equirectangular images containing malicious text that OCR extracts and the panorama viewer renders unsanitized via innerHTML. Exploitation permits session hijacking through persistent API key creation, exfiltration of private photos, GPS location history theft, and unauthorized access to facial biometric data. No public exploit identified at time of analysis.

Technical ContextAI

Root cause is improper neutralization of input (CWE-79) in panorama viewer's OCR text rendering path. OCR engine extracts text from uploaded equirectangular images, which is subsequently inserted into DOM via innerHTML without sanitization, allowing JavaScript execution in victim browsers accessing affected panoramas with OCR overlay active.

RemediationAI

Vendor-released patch: Immich 2.7.0 resolves this vulnerability through input sanitization in the panorama viewer OCR rendering pathway. Organizations should immediately upgrade all Immich instances to version 2.7.0 or later. As an interim workaround, disable OCR overlay functionality in the panorama viewer interface or restrict panorama upload permissions to trusted administrators only until patching is complete. Review API keys created during the vulnerability window for unauthorized persistent access tokens. Full vendor advisory available at https://github.com/immich-app/immich/security/advisories/GHSA-9qx4-67jm-cc66 with additional technical details and remediation guidance.