{"id":"CVE-2026-119328","kind":"vulnerability","aliases":["CVE-2026-119328"],"related":[],"title":"Immich: unauthenticated ML endpoint lets attackers choose cache path, delete directories","description":"Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated machine-learning /predict endpoint in machine-learning/immich_ml/main.py accepted an options object and passed its values into model construction in machine-learning/immich_ml/models/base.py without restricting security-sensitive parameters. An attacker with network access to the service could set cache_dir to an arbitrary writable path, causing model downloads to write there and causing clear_cache() to pass that path to shutil.rmtree() after selected model-loading failures. Depending on filesystem permissions and the selected path, this could modify files in mounted data locations or recursively delete an attacker-selected directory. The model-name allowlist prevents this issue from becoming arbitrary-model deserialization or code execution. This issue is fixed in version 3.3.0.","summary":"Immich's machine-learning /predict endpoint accepts a cache_dir option without restriction, so an unauthenticated network attacker can point model downloads at any writable path. After certain model-loading failures, the service recursively deletes that attacker-chosen directory, which can modify or wipe mounted data.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["docker","immich","package","self-hosted"],"not_affected_if":["ml-not-network-exposed","version-3.3.0-or-later"],"how_to_check":"- Check the Immich version in use; affected releases are those before `3.3.0`\n- Confirm whether the machine-learning container is reachable from the network, since the `/predict` endpoint is unauthenticated","fix":"- Immich: upgrade to `3.3.0` or later","status":"open","published_at":"2026-10-30T20:17:06+00:00","first_seen_at":"2026-10-30T20:25:37+00:00","triaged_at":"2026-10-30T20:26:49+00:00","updated_at":"2026-10-30T20:26:49+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T20:26:49Z","model":"claude-haiku-5-5","output":{"fix":"- Immich: upgrade to `3.3.0` or later","reach":"network","title":"Immich: unauthenticated ML endpoint lets attackers choose cache path, delete directories","impact":"medium","summary":"Immich's machine-learning /predict endpoint accepts a cache_dir option without restriction, so an unauthenticated network attacker can point model downloads at any writable path. After certain model-loading failures, the service recursively deletes that attacker-chosen directory, which can modify or wipe mounted data.","audience":"businesses","category":"package","nicknames":[],"who_cares":["immich","self-hosted","docker"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"attacker deletes or overwrites files in mounted data directories","analyst_note":"","how_to_check":"- Check the Immich version in use; affected releases are those before `3.3.0`\n- Confirm whether the machine-learning container is reachable from the network, since the `/predict` endpoint is unauthenticated","plain_action":"","needs_analyst":false,"not_affected_if":["version-3.3.0-or-later","ml-not-network-exposed"],"who_is_affected":"Any self-hosted Immich instance before 3.3.0 whose machine-learning service is reachable over the network, since its /predict endpoint requires no login. Instances where the ML service is only reachable inside a private container network or behind authentication are much less exposed. The sources say the model-name allowlist blocks code execution, so the risk is file writes and deletion.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00071,"input_tokens":4290,"output_tokens":562,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119328':14A,17A '-2026':13A,16A '/immich_ml/main.py':101C '/immich_ml/models/base.py':117C '/predict':29B,95C '3.3.0':89C,210C 'accept':31B,102C 'access':128C 'allowlist':191C 'arbitrari':138C,198C 'arbitrary-model':197C 'attack':6A,42B,63B,125C,184C 'attacker-chosen':62B 'attacker-select':183C 'becom':196C 'cach':8A,33B,134C,150C 'caus':141C,148C 'certain':52B 'choos':7A 'chosen':64B 'clear':149C 'code':202C 'construct':112C 'could':132C,172C 'cve':12A,15A 'data':72B,177C 'delet':10A,60B,181C 'depend':163C 'deseri':200C 'dir':34B,135C 'directori':11A,65B,186C 'docker':18B 'download':46B,143C 'endpoint':4A,30B,96C 'execut':203C 'failur':56B,162C 'file':174C 'filesystem':165C 'fix':207C 'high':77C 'high-perform':76C 'host':23B,81C 'immich':1A,19B,24B,73C 'issu':194C,205C 'learn':28B,94C,100C,116C 'let':5A 'load':55B,161C 'locat':178C 'machin':27B,93C,99C,115C 'machine-learn':26B,92C,98C,114C 'manag':85C 'ml':3A 'model':45B,54B,111C,142C,160C,189C,199C 'model-load':53B,159C 'model-nam':188C 'modifi':68B,173C 'mount':71B,176C 'name':190C 'network':41B,127C 'object':105C 'option':35B,104C 'packag':20B 'paramet':123C 'pass':107C,152C 'path':9A,50B,140C,154C,170C 'perform':78C 'permiss':166C 'photo':82C 'point':44B 'prevent':192C 'prior':87C 'recurs':59B,180C 'restrict':37B,119C 'secur':121C 'security-sensit':120C 'select':158C,169C,185C 'self':22B,80C 'self-host':21B,79C 'sensit':122C 'servic':58B,131C 'set':133C 'shutil.rmtree':156C 'solut':86C 'unauthent':2A,40B,91C 'valu':109C 'version':209C 'video':84C 'wipe':70B 'without':36B,118C 'writabl':49B,139C 'write':145C","nicknames":[],"mitigations":[],"who_affected":"Any self-hosted Immich instance before 3.3.0 whose machine-learning service is reachable over the network, since its /predict endpoint requires no login. Instances where the ML service is only reachable inside a private container network or behind authentication are much less exposed. The sources say the model-name allowlist blocks code execution, so the risk is file writes and deletion.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T20:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119328","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119328","severity":null,"published_at":"2026-10-30T20:17:06+00:00","modified_at":"2026-10-30T20:17:06+00:00","first_seen_at":"2026-10-30T20:25:37+00:00","fetched_at":"2026-10-30T20:25:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}