Remote Code Execution Vulnerability in Immich Photo Management Solution
CVE-2026-105764

7.7HIGH

Key Information:

Vendor

Immich-app

Status
Immich
Vendor
CVE Published:
5 October 2026

What is CVE-2026-105764?

Immich, a self-hosted solution for managing photos and videos, has a vulnerability that allows authenticated non-admin users to upload specially crafted SVG files. This security concern arises when the thumbnail generation process attempts to handle these SVG files. If an SVG file bypasses the native SVG loader of libvips, it can be processed by ImageMagick, leading to unrestricted access to MSL and VIDEO coding operations. An attacker can exploit this flaw by storing a malicious asset and referencing it from another SVG, thus executing arbitrary code within the immich-server container during thumbnail processing. This issue has been patched in version 3.2.4.

Affected Version(s)

immich < 3.2.4

References

https://github.com/immich-app/immich/security/advisories/...
x_refsource_CONFIRM
https://github.com/immich-app/immich/releases/tag/v3.2.4
x_refsource_MISC

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.