---
id: "CVE-2026-119328"
kind: "vulnerability"
aliases: ["CVE-2026-119328"]
title: "Immich: unauthenticated ML endpoint lets attackers choose cache path, delete directories"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["docker", "immich", "package", "self-hosted"]
not_affected_if: ["ml-not-network-exposed", "version-3.3.0-or-later"]
published_at: "2026-10-30T20:17:06+00:00"
first_seen_at: "2026-10-30T20:25:37+00:00"
updated_at: "2026-10-30T20:26:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119328", "first_seen_at": "2026-10-30T20:25:37+00:00"}]
---

# Immich: unauthenticated ML endpoint lets attackers choose cache path, delete directories

Immich's machine-learning /predict endpoint accepts a cache_dir option without restriction, so an unauthenticated network attacker can point model downloads at any writable path. After certain model-loading failures, the service recursively deletes that attacker-chosen directory, which can modify or wipe mounted data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Immich version in use; affected releases are those before `3.3.0`
- Confirm whether the machine-learning container is reachable from the network, since the `/predict` endpoint is unauthenticated

## Fix

- Immich: upgrade to `3.3.0` or later

## Timeline

- 2026-10-30T20:25:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119328

## From the sources

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated machine-learning /predict endpoint in machine-learning/immich_ml/main.py accepted an options object and passed its values into model construction in machine-learning/immich_ml/models/base.py without restricting security-sensitive parameters. An attacker with network access to the service could set cache_dir to an arbitrary writable path, causing model downloads to write there and causing clear_cache() to pass that path to shutil.rmtree() after selected model-loading failures. Depending on filesystem permissions and the selected path, this could modify files in mounted data locations or recursively delete an attacker-selected directory. The model-name allowlist prevents this issue from becoming arbitrary-model deserialization or code execution. This issue is fixed in version 3.3.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_