Immich: Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service
Affects the Immich machine-learning service in versions up to 3.0.3, when its port is reachable over the network. CVSS rates it 6.5 (medium). Fixed in v3.3.0.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 3.3.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Immich, a self-hosted photo and video management application, is affected through its machine-learning service. An unauthenticated network attacker could abuse this flaw to write model files to arbitrary directories or recursively delete an attacker-chosen directory, depending on the service's filesystem permissions.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated machine-learning /predict endpoint in machine-learning/immich_ml/main.py accepted an options object and passed its values into model construction in machine-learning/immich_ml/models/base.py without restricting security-sensitive parameters. An attacker with network access to the service could set cache_dir to an arbitrary writable path, causing model downloads to write there and causing clear_cache() to pass that path to shutil.rmtree() after selected model-loading failures. Depending on filesystem permissions and the selected path, this could modify files in mounted data locations or recursively delete an attacker-selected directory. The model-name allowlist prevents this issue from becoming arbitrary-model deserialization or code execution. This issue is fixed in version 3.3.0.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- immich-app immich
fixed in 3.3.0
References 4
GitHub · immich-app/immich
Questions about CVE-2026-119328
What does this mean?
The machine-learning service can be made to write attacker-supplied files into arbitrary writable directories and to recursively delete a directory whose name the attacker chooses. The attacker needs no login, but the delete step only runs after a model load fails with a specific file-error exception.Source: github.com
Am I affected, and how do I check?
Versions up to and including 3.0.3 of immich-app/immich are affected, specifically the machine-learning service, and only when its port is reachable over the network. To check, look at the Immich version in use and whether the machine-learning port is exposed beyond the host or private network.Source: github.com
What should I do about it?
Upgrade Immich to v3.3.0 or later, which contains the fix. The advisory lists no workaround.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data