---
id: CVE-2026-119328
title: >-
  Immich: Unauthenticated filesystem path injection (arbitrary directory write +
  recursive delete) in the machine-learning service
summary: >-
  Immich is a high-performance self-hosted photo and video management solution.
  Prior to 3.3.0, the unauthenticated machine-learning /predict endpoint in
  machine-learning/immich_ml/main.py accepted an options object and passed its
  values i…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-22
  - CWE-73
vendor: immich-app
product: immich
affected:
  - immich < 3.3.0
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T19:50:02.460Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119328'
references:
  - url: >-
      https://github.com/immich-app/immich/security/advisories/GHSA-72rm-x7xr-v679
    label: >-
      https://github.com/immich-app/immich/security/advisories/GHSA-72rm-x7xr-v679
  - url: 'https://github.com/immich-app/immich/pull/31856'
    label: 'https://github.com/immich-app/immich/pull/31856'
  - url: >-
      https://github.com/immich-app/immich/commit/ab159b81182f26a8943f5dd66b719e8cdaad4626
    label: >-
      https://github.com/immich-app/immich/commit/ab159b81182f26a8943f5dd66b719e8cdaad4626
  - url: 'https://github.com/immich-app/immich/releases/tag/v3.3.0'
    label: 'https://github.com/immich-app/immich/releases/tag/v3.3.0'
tags:
  - cve.org
epss: 0.00436
epssPercentile: 0.38043
ingestedAt: '2026-11-05T16:24:31.417Z'
---

## Overview

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated machine-learning /predict endpoint in machine-learning/immich_ml/main.py accepted an options object and passed its values into model construction in machine-learning/immich_ml/models/base.py without restricting security-sensitive parameters. An attacker with network access to the service could set cache_dir to an arbitrary writable path, causing model downloads to write there and causing clear_cache() to pass that path to shutil.rmtree() after selected model-loading failures. Depending on filesystem permissions and the selected path, this could modify files in mounted data locations or recursively delete an attacker-selected directory. The model-name allowlist prevents this issue from becoming arbitrary-model deserialization or code execution. This issue is fixed in version 3.3.0.

## Affected

- `immich < 3.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.