immich
v3.4.1High performance self-hosted photo and video management solution.
- Maintenance
- Active992 commits in 3 months · bus factor 4
- License
- AGPL-3.0Copyleft · OSI-approved
- Security
- 30 advisories3 high, 21 medium, 6 low
- Supported versions
- No scheduleendoflife.date does not track this project
119k stars · 7.6k forks · 683 open issues · last release 3 days ago · data checked 2 hours ago
Security advisories
All advisories on GitHubThe 30 most recent advisories published by the maintainers: 3 high, 21 medium, 6 low. Check the patched version against the one you run.
- mediumGHSA-jrj8-j4f9-9v85Nov 10, 2026Album Owner Information Disclosure via Shared Links
- Affected
- <= v3.3.6
- Patched in
- v3.4.0
- mediumGHSA-v94m-9pp2-pm59Nov 10, 2026Email HTML injection
- Affected
- <= v3.3.6
- Patched in
- v3.4.0
- mediumGHSA-j722-3hvf-c9vrNov 10, 2026Immich partner reads archived timeline metadata
- Affected
- <= v3.3.6
- Patched in
- v3.4.0
- mediumGHSA-rq4j-mp2m-85qpNov 10, 2026Shared-link archive downloads can bypass edited-asset enforcement and include original files
- Affected
- <= v3.3.6
- Patched in
- v3.4.0
- mediumGHSA-wwfq-95jq-3m3cNov 10, 2026Path Traversal via Improper Prefix Check in Storage Template Engine (unsanitized EXIF Make/Model/LensModel)
- Affected
- <= v3.3.6
- Patched in
- v3.4.0
- lowGHSA-8xfw-gq8x-8mrrNov 10, 2026Unanchored Regex Allows Complete Bypass of Plugin allowedHosts SSRF Protection
- Affected
- <= v3.3.6
- Patched in
- v3.4.0
- mediumGHSA-wp5v-5wj6-j2fhNov 10, 2026Arbitrary File Read via Symlink Following in External Library Import
- Affected
- <= v3.3.6
- Patched in
- v3.4.0
- lowGHSA-wjrq-m9hw-r4vqNov 10, 2026Stored XSS via SVG Asset
- Affected
- <= v3.3.6
- Patched in
- v3.4.0
- mediumGHSA-6jjx-fxr3-8vf2Nov 10, 2026Cross-owner metadata write via POST /duplicates/resolve
- Affected
- <= v3.3.6
- Patched in
- v3.4.0
- mediumGHSA-9g87-8gwq-4xqpNov 10, 2026Shared-link upload runs as the link owner, so the livePhotoVideoId owner check can never fail
- Affected
- <= v3.3.6
- Patched in
- v3.4.0
- highGHSA-7j23-rprg-3g5qNov 10, 2026Attacker-chosen OAuth `state` cookie allows forced account linking and takeover of any account (bypasses the CVE-2025-43856 fix)
- Affected
- <= v3.3.6
- Patched in
- v3.4.0
- mediumGHSA-gjj9-fvfp-jw63Nov 10, 2026Shared link "Show metadata" is not applied to POST /search/metadata, leaking EXIF and GPS
- Affected
- <= v3.3.6
- Patched in
- v3.4.0
- mediumGHSA-p632-vh57-j6x4Nov 10, 2026Malicious or MITM Immich server can read, exfiltrate and delete arbitrary local files via the @immich/cli duplicate check
- Affected
- <= v3.3.6
- Patched in
- v3.4.0
- mediumGHSA-v7v2-63g5-gwf7Nov 10, 2026Partner can read the sharer's Locked Folder metadata when a search request omits visibility
- Affected
- <= v3.3.6
- Patched in
- v3.4.0
- lowGHSA-xm8q-2hq2-gpxgNov 10, 2026A share link with uploads disabled can test whether the owner has a given file
- Affected
- <= v3.3.6
- Patched in
- v3.4.0
- mediumGHSA-c9h4-ccvj-j2h2Nov 10, 2026Unbounded motion-photo offset causes memory and disk exhaustion
- Affected
- <= v3.3.6
- Patched in
- v3.4.0
- mediumGHSA-qcp2-7vph-gq64Nov 10, 2026Read-scoped API keys can reset cluster-group people data
- Affected
- <= v3.3.6
- Patched in
- v3.4.0
- highCVE-2026-77439Oct 19, 2026Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints
- Affected
- <= 3.0.0
- Patched in
- v3.0.3
- lowCVE-2026-119330Oct 19, 2026A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API
- Affected
- <=3.1.0
- Patched in
- v3.2.0
- mediumCVE-2026-119328Oct 19, 2026Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service
- Affected
- <= 3.0.3
- Patched in
- v3.3.0
- mediumGHSA-3mh5-gqfm-phgjOct 19, 2026Cross-user disclosure of a user's Locked (hidden-vault) assets to a partner via timeline-bucket and search-statistics endpoints
- Affected
- <= 3.0.3
- Patched in
- v3.1.0
- mediumCVE-2026-119329Oct 19, 2026Partner "view-only" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers (the map endpoint omits the archived-asset guard the timeline endpoint enforces)
- Affected
- <= v2.7.5 (current release)
- Patched in
- v3.0.0
- mediumCVE-2026-104867Oct 13, 2026Broken access control: GET /api/admin/users/{id}/calendar-heatmap is reachable by any authenticated non-admin user (cross-user activity/asset-count disclosure, includes archived and locked assets)
- Affected
- >= 3.0.0, <= 3.0.3
- highCVE-2026-105764Sep 28, 2026Authenticated SVG upload reaches ImageMagick coders and enables RCE
- Affected
- v3.2.2
- Patched in
- v3.2.4
- lowGHSA-h5w4-vjv4-9r5qAug 23, 2026Incorrect sanitization of continue URL on the /maintenance endpoint
- Affected
- <= v3.1.0
- Patched in
- None
- mediumGHSA-hfvf-5c8x-8rc4Jul 6, 2026OIDC discovery/token/userinfo/JWKS fetches run with TLS certificate verification unconditionally disabled via allowInsecureRequests (CWE-295)
- Affected
- <=latest
- Patched in
- v3.0.0
- mediumGHSA-qp2h-w794-2vhfJul 6, 2026Incomplete fix for login continue redirect allows slash-backslash open redirect
- Affected
- <= 2.7.5, and current main e2de8c7c536cac5a673a3aa60cc998815b62d247 after PR #28706
- Patched in
- v3.0.0
- mediumGHSA-hq46-gw2v-q86pJul 6, 2026SSRF via OAuth Profile Picture URL (CWE-918)
- Affected
- <= 1.129.0
- Patched in
- v3.0.0
- mediumGHSA-hvq7-hq9r-8gjrJul 6, 2026[DCODX-AI] Shared-link authentication allows adding owner's assets to shared links (AssetShare authorization bypass)
- Affected
- <=2.1.0
- Patched in
- v3.0.0
- lowGHSA-jrp5-g662-hq92Jul 6, 2026Unsafe ZIP Entry Names (Zip Slip Class) in Archive Download Endpoint
- Affected
- >2.6.2
- Patched in
- 3.0.0