CVE-2026-119328— Immich: Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service

Quick assessment

Affected

immich-app immich

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Immich 是一款高性能的自托管照片与视频管理解决方案。在 3.3.0 版本之前，中未经验证的机器学习端点会接收一个 options 对象，并将其中的值直接传入中的模型构建流程，且未对安全敏感参数进行限制。拥有网络访问权限的攻击者可利用此漏洞，将设置为任意可写路径，导致模型下载文件被写入该路径；而在模型加载失败后，函数会将该路径传递给。具体影响取决于文件系统权限及所选路径：攻击者可能修改挂载数据目录中的文件，或递归删除其指定的任意目录。由于存在模型名称白名单机制，该问题无法进一步演变为任意模型反序列化

CVSS 6.5 · Medium Updated Oct 31, 2026

Possible ATT&CK Techniques 3 AI

T1485 · Data Destruction T1565.004 T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Immich: Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service

Source: CVE Program / CVE List V5

Vulnerability Description

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated machine-learning /predict endpoint in machine-learning/immich_ml/main.py accepted an options object and passed its values into model construction in machine-learning/immich_ml/models/base.py without restricting security-sensitive parameters. An attacker with network access to the service could set cache_dir to an arbitrary writable path, causing model downloads to write there and causing clear_cache() to pass that path to shutil.rmtree() after selected model-loading failures. Depending on filesystem permissions and the selected path, this could modify files in mounted data locations or recursively delete an attacker-selected directory. The model-name allowlist prevents this issue from becoming arbitrary-model deserialization or code execution. This issue is fixed in version 3.3.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
immich-app	immich	< 3.3.0	-

II. Public POCs for CVE-2026-119328

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119328

请登录查看更多情报信息。

Other References for CVE-2026-119328 (4)

https://github.com/immich-app/immich/pull/31856 x_refsource_MISC
https://github.com/immich-app/immich/releases/tag/v3.3.0 x_refsource_MISC
https://github.com/immich-app/immich/security/advisories/GHSA-72rm-x7xr-v679 x_refsource_CONFIRM
https://github.com/immich-app/immich/commit/ab159b81182f26a8943f5dd66b719e8cdaad4626 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-119328

Same Patch Batch · immich-app · 2026-10-30 · 3 CVEs total

CVE-2026-119329	4.3 MEDIUM	Immich: Partner "view-only" sharing leaks GPS coordinates of the sharer's archived assets
CVE-2026-119330	3.5 LOW	Immich: A regular user can create SharedLink for album/asset belonging to another user thr

IV. Related Vulnerabilities

Same product: immich

Same vendor: immich-app

Same weakness: CWE-22