CVE-2026-119328

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated machine-learning /predict endpoint in machine-learning/immich_ml/main.py accepted an options object and passed its values into model construction in machine-learning/immich_ml/models/base.py without restricting security-sensitive parameters. An attacker with network access to the service could set cache_dir to an arbitrary writable path, causing model downloads to write there and causing clear_cache() to pass that path to shutil.rmtree() after selected model-loading failures. Depending on filesystem permissions and the selected path, this could modify files in mounted data locations or recursively delete an attacker-selected directory. The model-name allowlist prevents this issue from becoming arbitrary-model deserialization or code execution. This issue is fixed in version 3.3.0.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/immich-app/immich/commit/ab159b81182f26a8943f5dd66b719e8cdaad4626
https://github.com/immich-app/immich/pull/31856
https://github.com/immich-app/immich/releases/tag/v3.3.0
https://github.com/immich-app/immich/security/advisories/GHSA-72rm-x7xr-v679

Configurations

No configuration.

History

30 Oct 2026, 20:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-30 20:17

Updated : 2026-10-30 20:17

NVD link : CVE-2026-119328

Mitre link : CVE-2026-119328

CVE.ORG link : CVE-2026-119328

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-73

External Control of File Name or Path

{"id": "CVE-2026-119328", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "immich-app", "product": "immich", "versions": [{"status": "affected", "version": "< 3.3.0"}]}]}], "published": "2026-10-30T20:17:06.627", "references": [{"url": "https://github.com/immich-app/immich/commit/ab159b81182f26a8943f5dd66b719e8cdaad4626", "source": "security-advisories@github.com"}, {"url": "https://github.com/immich-app/immich/pull/31856", "source": "security-advisories@github.com"}, {"url": "https://github.com/immich-app/immich/releases/tag/v3.3.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/immich-app/immich/security/advisories/GHSA-72rm-x7xr-v679", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-73"}]}], "descriptions": [{"lang": "en", "value": "Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated machine-learning /predict endpoint in machine-learning/immich_ml/main.py accepted an options object and passed its values into model construction in machine-learning/immich_ml/models/base.py without restricting security-sensitive parameters. An attacker with network access to the service could set cache_dir to an arbitrary writable path, causing model downloads to write there and causing clear_cache() to pass that path to shutil.rmtree() after selected model-loading failures. Depending on filesystem permissions and the selected path, this could modify files in mounted data locations or recursively delete an attacker-selected directory. The model-name allowlist prevents this issue from becoming arbitrary-model deserialization or code execution. This issue is fixed in version 3.3.0."}], "lastModified": "2026-10-30T20:17:06.757", "sourceIdentifier": "security-advisories@github.com"}