{"id":"CVE-2026-119328","title":"Immich: Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service","summary":"Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated machine-learning /predict endpoint in machine-learning/immich_ml/main.py accepted an options object and passed its values i…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","cvssSource":"cna","cwe":["CWE-22","CWE-73"],"vendor":"immich-app","product":"immich","affected":["immich < 3.3.0"],"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T19:50:02.460Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119328","references":[{"url":"https://github.com/immich-app/immich/security/advisories/GHSA-72rm-x7xr-v679","label":"https://github.com/immich-app/immich/security/advisories/GHSA-72rm-x7xr-v679"},{"url":"https://github.com/immich-app/immich/pull/31856","label":"https://github.com/immich-app/immich/pull/31856"},{"url":"https://github.com/immich-app/immich/commit/ab159b81182f26a8943f5dd66b719e8cdaad4626","label":"https://github.com/immich-app/immich/commit/ab159b81182f26a8943f5dd66b719e8cdaad4626"},{"url":"https://github.com/immich-app/immich/releases/tag/v3.3.0","label":"https://github.com/immich-app/immich/releases/tag/v3.3.0"}],"tags":["cve.org"],"epss":0.00436,"epssPercentile":0.38043,"ingestedAt":"2026-11-05T16:24:31.417Z","slug":"CVE-2026-119328","body":"## Overview\n\nImmich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated machine-learning /predict endpoint in machine-learning/immich_ml/main.py accepted an options object and passed its values into model construction in machine-learning/immich_ml/models/base.py without restricting security-sensitive parameters. An attacker with network access to the service could set cache_dir to an arbitrary writable path, causing model downloads to write there and causing clear_cache() to pass that path to shutil.rmtree() after selected model-loading failures. Depending on filesystem permissions and the selected path, this could modify files in mounted data locations or recursively delete an attacker-selected directory. The model-name allowlist prevents this issue from becoming arbitrary-model deserialization or code execution. This issue is fixed in version 3.3.0.\n\n## Affected\n\n- `immich < 3.3.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}