CVE-2026-119328 in Immich
Summary
by MITRE • 10/30/2026
Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated machine-learning /predict endpoint in machine-learning/immich_ml/main.py accepted an options object and passed its values into model construction in machine-learning/immich_ml/models/base.py without restricting security-sensitive parameters. An attacker with network access to the service could set cache_dir to an arbitrary writable path, causing model downloads to write there and causing clear_cache() to pass that path to shutil.rmtree() after selected model-loading failures. Depending on filesystem permissions and the selected path, this could modify files in mounted data locations or recursively delete an attacker-selected directory. The model-name allowlist prevents this issue from becoming arbitrary-model deserialization or code execution. This issue is fixed in version 3.3.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified involves a critical flaw within the Immich self-hosted photo and video management solution, specifically affecting versions prior to 3.3.0. The core of this security deficiency lies in the unauthenticated machine-learning endpoint located at /predict, which is implemented in the main.py file of the immich_ml module. This endpoint accepts an options object from incoming requests without performing adequate validation on its contents. Specifically, it passes values directly into model construction logic found in base.py, allowing a remote attacker with network access to manipulate internal configuration parameters that control filesystem operations.
The technical flaw centers on the handling of the cache_dir parameter within the provided options object. Because this value is not restricted or sanitized before being used by the underlying machine learning models, an attacker can specify an arbitrary writable path for model downloads and temporary file storage. This lack of input validation enables two distinct attack vectors depending on the target environment's filesystem permissions and directory structure. First, if the specified cache_dir points to a location within mounted data volumes or other sensitive directories where the application process has write access, the attacker can force the system to download malicious model files into those locations. This effectively allows for unauthorized file creation in areas that may contain critical user data or configuration files.
Second, and more severely, the vulnerability facilitates arbitrary directory deletion through a logic error triggered during model loading failures. The code includes a clear_cache() function designed to clean up temporary resources when specific models fail to load correctly. However, because this function utilizes shutil.rmtree(), it will recursively delete whatever path was previously set as the cache_dir by the attacker's request. If an adversary sets this parameter to a critical system directory or user data folder and triggers the failure condition that invokes clear_cache(), they can cause significant denial of service by permanently destroying essential files and directories. This represents a severe integrity compromise, potentially leading to complete loss of application functionality or persistent data destruction for affected users.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the system fails to restrict unacceptable inputs passed to internal APIs. Furthermore, it relates to CWE-73 External Control of File Name or Path, which allows attackers to influence file operations through manipulated parameters. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior corresponds to techniques involving Data Destruction and potentially Impair Defenses if the deleted directories are part of backup or logging mechanisms. The ability to write arbitrary files also touches upon CWE-436 Interpretation Conflict if those files interfere with other system processes interpreting file contents.
It is important to note that while the vulnerability allows for significant filesystem manipulation, it does not currently lead to remote code execution or arbitrary model deserialization. This limitation exists because Immich employs a strict allowlist for valid model names during the loading process. Consequently, an attacker cannot load custom Python scripts or malicious serialized objects directly through this endpoint, which mitigates the risk of immediate command injection. However, the ability to overwrite configuration files or delete data remains a critical threat that undermines the confidentiality and integrity guarantees expected from self-hosted services.
To mitigate this vulnerability, organizations running Immich must upgrade immediately to version 3.3.0 or later, where these input validation checks have been implemented. Until an update is applied, administrators should consider restricting network access to the machine-learning endpoint using firewall rules or reverse proxy configurations that limit exposure to trusted internal networks only. Additionally, ensuring that the application runs under a restricted user account with minimal filesystem permissions can reduce the blast radius of any successful exploitation attempt by preventing writes to critical system directories. Regular auditing of file integrity and backup verification procedures are also recommended to detect any potential unauthorized modifications or deletions resulting from prior exposure.