Immich App
Monthly
Remote code execution in Immich before 3.2.4 lets any authenticated non-admin user with upload permission run arbitrary code inside the immich-server container. The exploit chains two crafted SVG assets: a stored reference asset and a second 'delayed-marker' SVG whose attacker-controlled <image href> value reaches ImageMagick's unrestricted MSL and VIDEO coders after the file bypasses libvips' native SVG loader, with execution occurring when the server generates a thumbnail. The attack is high-complexity and depends on the ImageMagick fallback path being reachable with those coders enabled; version 3.2.4 contains the fix, and no public exploit code was identified at time of analysis.
Locked asset visibility bypass in Immich through 3.1.0 exposes private photo and video assets to unauthorized viewers via shared albums and shared links. When a user locks an asset using the single-asset locking endpoint, the lock flag is not enforced by the access control logic that governs shared album and shared link contexts, leaving those assets readable through pre-existing shares. An authenticated or link-holding attacker can enumerate and retrieve locked media and its metadata without any further privilege escalation. No public exploit or CISA KEV listing has been identified at time of analysis.
Album ownership takeover in immich before 3.0.3 allows a user with shared-album editor access to escalate to full owner by abusing the PUT /albums/:id/user/:userId endpoint (CWE-863, Incorrect Authorization). Because the endpoint fails to enforce owner-only restrictions on role changes, an editor can demote the legitimate owner and promote themselves across two sequential requests, gaining deletion and member-eviction control over the album and its assets. Publicly available exploit code exists and a vendor patch (v3.0.3) has shipped, though it is not currently listed in CISA KEV.
Reflected cross-site scripting in Immich (commits 4ffa26c9 through pre-4eb1003) allows a single-click account takeover of any authenticated user by abusing the unvalidated continue query parameter on /auth/login, which is passed directly to SvelteKit's redirect() without scheme or origin checks. The payload executes attacker-controlled JavaScript inside Immich's origin and uses the victim's session to mint an all-permission API key, yielding persistent compromise. No public exploit identified at time of analysis, but the upstream fix commit and a detailed GHSA advisory describe the flaw clearly enough to derive a working PoC.
Authenticated partners in Immich through 3.3.1 can read metadata from assets stored in another user's Locked Folder - including GPS coordinates, capture times, descriptions and camera details - via the partner synchronization stream, because sync queries fail to exclude assets marked with Locked visibility. The attacker must already hold an active, victim-accepted partner relationship and be authenticated, and publicly available exploit code exists demonstrating the technique (no CISA KEV confirmation of active exploitation). Impact is confined to metadata disclosure of Locked Folder assets; image/video binaries, credentials, and data belonging to non-partnered users are not exposed, making this a moderate-severity information-disclosure issue rather than an emergency.
Improper authorization in Immich's Shared Link Preview Handler (server/src/utils/access.ts, function checkSharedLinkAccess) affects Immich releases up to and including 2.7.5 and allows a remote, unauthenticated attacker who knows or obtains a shared link's URL/token to bypass that link's password protection and view media that should require a password. The assessed impact is confined to confidentiality (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N; CWE-285), with no integrity or availability effect, and instances that do not use password-protected shared links are unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis (the CVE is not listed in CISA KEV), and the originating GitHub report (immich-app/immich issue 29599) was closed as a duplicate, so a vendor-confirmed fix version should be verified directly with the project.
Open redirect vulnerability in Immich prior to version 2.7.3 allows authenticated attackers to craft malicious shared album names that inject unsanitized HTML into Open Graph meta tags, redirecting victims' browsers to attacker-controlled sites when they open the share link. This enables phishing attacks where victims can be directed to credential-harvesting sites that impersonate the Immich login interface, exploiting user trust in the shared album feature.
Stored Cross-Site Scripting in Immich photo management platform versions prior to 2.7.0 enables authenticated attackers to execute arbitrary JavaScript when victims view malicious 360° panorama images with OCR overlay enabled. Attackers upload specially crafted equirectangular images containing malicious text that OCR extracts and the panorama viewer renders unsanitized via innerHTML. Exploitation permits session hijacking through persistent API key creation, exfiltration of private photos, GPS location history theft, and unauthorized access to facial biometric data. No public exploit identified at time of analysis.
Immich prior to version 2.6.0 discloses shared album passwords in cleartext within URL query parameters during authentication to /api/shared-links/me, exposing credentials to browser history, proxy logs, server logs, and HTTP referrer headers. An unauthenticated attacker with access to these logs or referrer data can obtain album passwords and compromise shared album access, affecting all installations using shared albums with password protection before the patch.
Remote code execution in Immich before 3.2.4 lets any authenticated non-admin user with upload permission run arbitrary code inside the immich-server container. The exploit chains two crafted SVG assets: a stored reference asset and a second 'delayed-marker' SVG whose attacker-controlled <image href> value reaches ImageMagick's unrestricted MSL and VIDEO coders after the file bypasses libvips' native SVG loader, with execution occurring when the server generates a thumbnail. The attack is high-complexity and depends on the ImageMagick fallback path being reachable with those coders enabled; version 3.2.4 contains the fix, and no public exploit code was identified at time of analysis.
Locked asset visibility bypass in Immich through 3.1.0 exposes private photo and video assets to unauthorized viewers via shared albums and shared links. When a user locks an asset using the single-asset locking endpoint, the lock flag is not enforced by the access control logic that governs shared album and shared link contexts, leaving those assets readable through pre-existing shares. An authenticated or link-holding attacker can enumerate and retrieve locked media and its metadata without any further privilege escalation. No public exploit or CISA KEV listing has been identified at time of analysis.
Album ownership takeover in immich before 3.0.3 allows a user with shared-album editor access to escalate to full owner by abusing the PUT /albums/:id/user/:userId endpoint (CWE-863, Incorrect Authorization). Because the endpoint fails to enforce owner-only restrictions on role changes, an editor can demote the legitimate owner and promote themselves across two sequential requests, gaining deletion and member-eviction control over the album and its assets. Publicly available exploit code exists and a vendor patch (v3.0.3) has shipped, though it is not currently listed in CISA KEV.
Reflected cross-site scripting in Immich (commits 4ffa26c9 through pre-4eb1003) allows a single-click account takeover of any authenticated user by abusing the unvalidated continue query parameter on /auth/login, which is passed directly to SvelteKit's redirect() without scheme or origin checks. The payload executes attacker-controlled JavaScript inside Immich's origin and uses the victim's session to mint an all-permission API key, yielding persistent compromise. No public exploit identified at time of analysis, but the upstream fix commit and a detailed GHSA advisory describe the flaw clearly enough to derive a working PoC.
Authenticated partners in Immich through 3.3.1 can read metadata from assets stored in another user's Locked Folder - including GPS coordinates, capture times, descriptions and camera details - via the partner synchronization stream, because sync queries fail to exclude assets marked with Locked visibility. The attacker must already hold an active, victim-accepted partner relationship and be authenticated, and publicly available exploit code exists demonstrating the technique (no CISA KEV confirmation of active exploitation). Impact is confined to metadata disclosure of Locked Folder assets; image/video binaries, credentials, and data belonging to non-partnered users are not exposed, making this a moderate-severity information-disclosure issue rather than an emergency.
Improper authorization in Immich's Shared Link Preview Handler (server/src/utils/access.ts, function checkSharedLinkAccess) affects Immich releases up to and including 2.7.5 and allows a remote, unauthenticated attacker who knows or obtains a shared link's URL/token to bypass that link's password protection and view media that should require a password. The assessed impact is confined to confidentiality (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N; CWE-285), with no integrity or availability effect, and instances that do not use password-protected shared links are unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis (the CVE is not listed in CISA KEV), and the originating GitHub report (immich-app/immich issue 29599) was closed as a duplicate, so a vendor-confirmed fix version should be verified directly with the project.
Open redirect vulnerability in Immich prior to version 2.7.3 allows authenticated attackers to craft malicious shared album names that inject unsanitized HTML into Open Graph meta tags, redirecting victims' browsers to attacker-controlled sites when they open the share link. This enables phishing attacks where victims can be directed to credential-harvesting sites that impersonate the Immich login interface, exploiting user trust in the shared album feature.
Stored Cross-Site Scripting in Immich photo management platform versions prior to 2.7.0 enables authenticated attackers to execute arbitrary JavaScript when victims view malicious 360° panorama images with OCR overlay enabled. Attackers upload specially crafted equirectangular images containing malicious text that OCR extracts and the panorama viewer renders unsanitized via innerHTML. Exploitation permits session hijacking through persistent API key creation, exfiltration of private photos, GPS location history theft, and unauthorized access to facial biometric data. No public exploit identified at time of analysis.
Immich prior to version 2.6.0 discloses shared album passwords in cleartext within URL query parameters during authentication to /api/shared-links/me, exposing credentials to browser history, proxy logs, server logs, and HTTP referrer headers. An unauthenticated attacker with access to these logs or referrer data can obtain album passwords and compromise shared album access, affecting all installations using shared albums with password protection before the patch.