Immich ML Service EUVD-2026-114375

The ML FastAPI service must be network-reachable on its port (3003), which is the default: it has no authentication on any route and binds all interfaces, and the release docker-compose.prod.yml publishes 3003:3003 (otherwise it is still reachable to anything on the Docker network or in remote-ML deployments). The arbitrary-write sink triggers on any /predict request because snapshot_download writes to the attacker-supplied cache_dir. The destructive recursive-delete sink additionally requires inducing a model-load failure (OSError/InvalidProtobuf/BadZipFile/NoSuchFile), which the attacker can provoke, e.g. via a model_format mismatch. Actual impact is bounded by container filesystem permissions and whether the chosen path is writable/deletable by the ML process; the model-name allowlist limits the flaw to path write/delete and prevents escalation to code execution. Affected versions are <= 3.0.3 (confirmed), fixed in 3.3.0.

This is a genuine, unauthenticated, network-reachable integrity/availability flaw (CWE-22/CWE-73) in Immich's machine-learning service, but the severity signals conflict and must be reconciled. CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote, low-complexity, unauthenticated exploitation with no user interaction - the advisory corroborates this (no auth on any ML route, binds [::]:3003, docker-compose.prod.yml publishes 3003:3003). The two CVSS scores disagree on impact: NVD rates it 6.5 with C:N/I:L/A:L, while the vendor GHSA rates it 8.6 with C:N/I:H/A:H. The discrepancy is explicitly about impact magnitude, not mechanism: the primary() sink is shutil.rmtree() on an attacker-chosen cache_dir, which can recursively delete a mounted photo/data volume - that justifies the vendor's I:H/A:H, and I assess the higher impact as the more defensible reading because data loss of a mounted library is realistic. No EPSS score and no KEV status were provided, so there is no evidence of active exploitation; the vuln.today decision label is this_month (prioritize, not emergency). A validated proof-of-concept is published in the GHSA advisory itself (the author states the real shutil.rmtree deleted an attacker-named directory on the Linux code path), so working exploitation detail is public even though this is not CISA-KEV-listed. Importantly, the advisory and the CVE description both confirm the model-name allowlist prevents escalation to arbitrary-model deserialization or RCE - despite the input Tags claiming 'RCE' and 'Deserialization', those are not achievable here. Net: a real priority for any internet- or shared-network-exposed ML deployment, bounded to write/delete (no confidentiality, no code execution), not a theoretical high-CVSS-only issue.

An attacker with network access to the unauthenticated ML service (default port 3003) sends a crafted /predict request whose options object sets cache_dir to a sensitive writable path such as a mounted /data photo volume; model files are written there, and by inducing a model-load failure (e.g. a model_format mismatch) the attacker causes clear_cache() to call shutil.rmtree() on that path, recursively deleting it. A validated proof-of-concept curl request is published in the GHSA advisory, which states the real shutil.rmtree deleted an attacker-named victim directory on the Linux container path.