immich-app Immich up to 3.2.3 Thumbnail Generation media.repository.ts unrestricted upload

Summaryinfo

A vulnerability was found in immich-app Immich up to 3.2.3. It has been declared as critical. The impacted element is an unknown function of the file server/src/repositories/media.repository.ts of the component Thumbnail Generation. Executing a manipulation can lead to unrestricted upload. This vulnerability is registered as CVE-2026-105764. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in immich-app Immich up to 3.2.3 and classified as critical. This vulnerability affects some unknown processing of the file server/src/repositories/media.repository.ts of the component Thumbnail Generation. The manipulation with an unknown input leads to a unrestricted upload vulnerability. The CWE definition for the vulnerability is CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumbnail-generation code in server/src/repositories/media.repository.ts passed to libvips. Files that bypassed libvips' native SVG loader fell through to ImageMagick, where attacker-controlled <image href> values reached unrestricted MSL and VIDEO coder operations. By storing one crafted asset and referencing its path from a second delayed-marker SVG, an attacker could execute code in the immich-server container when thumbnail processing ran. This issue is fixed in version 3.2.4.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-105764 since 10/05/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1608.002.

Upgrading to version 3.2.4 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• immich-app

Name

• Immich

Version

• 3.2.0
• 3.2.1
• 3.2.2
• 3.2.3

Website

• Product: https://github.com/immich-app/immich/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion