CVE-2026-105764 in Immich
Summary
by MITRE • 10/06/2026
Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumbnail-generation code in server/src/repositories/media.repository.ts passed to libvips. Files that bypassed libvips' native SVG loader fell through to ImageMagick, where attacker-controlled <image href> values reached unrestricted MSL and VIDEO coder operations. By storing one crafted asset and referencing its path from a second delayed-marker SVG, an attacker could execute code in the immich-server container when thumbnail processing ran. This issue is fixed in version 3.2.4.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/06/2026
Immich presents itself as a high-performance self-hosted solution for photo and video management, yet prior to version 3.2.4 it contained a critical server-side request forgery vulnerability rooted in its media processing pipeline. The flaw specifically affects authenticated non-admin users who possess the ability to upload files to the platform. While the application implements certain security controls by restricting direct execution of uploaded content, the internal mechanism for generating thumbnails introduces a complex attack surface involving multiple image processing libraries. When an SVG file is uploaded, the server-side code located in media.repository.ts attempts to process this asset using libvips as the primary handler due to its performance advantages over other engines. However, the implementation fails to adequately validate or restrict all possible input vectors within the SVG format before passing them downstream if they do not conform strictly to what libvips can natively parse and render.
The core technical flaw lies in the fallback behavior of the thumbnail generation logic. When an uploaded SVG file contains elements that are unsupported by libvips, such as specific image references or complex filters, the system does not reject the file outright but instead passes it through to ImageMagick for processing. This transition is critical because ImageMagick utilizes a meta-format called Magick Scripting Language (MSL) and supports various coder operations including VIDEO that allow for significant control over how images are rendered. An attacker can craft an SVG payload where specific attributes, particularly the image href values, are manipulated to reference local system paths or trigger external resource loads. Because these references reach unrestricted MSL and VIDEO coder operations within ImageMagick, they bypass the intended sandboxing of libvips and expose the underlying server infrastructure to arbitrary code execution risks during thumbnail generation.
The exploitation strategy for this vulnerability relies on a two-stage approach that leverages timing delays inherent in image processing pipelines. An attacker first stores one crafted asset containing malicious SVG content designed to exploit ImageMagick's parsing logic. This initial upload triggers the creation of thumbnails, but due to the complexity or specific structure of the payload, the execution might be delayed or queued for background processing. The attacker then uploads a second SVG file that includes a delayed marker referencing the path of the first crafted asset. When the thumbnail generation service processes this second file and attempts to resolve references from the first, it inadvertently executes the malicious MSL commands embedded in the original payload. This sequence allows an unprivileged user to achieve remote code execution within the immich-server container environment, effectively breaking out of the application's isolation boundaries.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) and CWE-20 Improper Input Validation, as the system fails to sanitize or restrict input data that leads to unintended code execution. In terms of tactical mapping under MITRE ATT&CK, this represents a Server-Side Request Forgery combined with Command Injection techniques, where the attacker uses legitimate application features to trigger unauthorized actions on the backend infrastructure. The impact is severe because it grants an authenticated user full control over the server container hosting Immich, potentially leading to data exfiltration, lateral movement within the network, or complete compromise of the self-hosted environment.
Mitigation for this issue requires immediate upgrading to version 3.2.4 where the vulnerability has been patched by restricting the input types passed to ImageMagick and ensuring that SVG files are either strictly validated against a safe subset of features before processing or handled entirely within libvips without fallback to more permissive engines like ImageMagick for untrusted inputs. Administrators should also consider implementing strict file type validation at the upload gateway level, rejecting any SVG files if thumbnail generation is not absolutely required for all uploaded content, and monitoring server logs for unusual patterns in image processing requests that might indicate attempted exploitation of similar flaws in other components.