# CVE-2026-119328: Immich unauthenticated path traversal in ML endpoint

Source: https://junglewise.ai/threats/cve-2026-119328-immich-is-a-high-performance-self-hosted-photo-and-video  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-119328 · Severity: medium · CVSS 6.5 · Published 2026-10-30

Immich is a self-hosted photo and video management system. An unauthenticated attacker with network access can exploit the machine-learning /predict endpoint to set arbitrary cache directories, potentially modifying or deleting files on the server's filesystem, or corrupting the application's mounted data locations.

Vendors: [Immich-App](https://junglewise.ai/threats/vendors/immich-app).

## Quick answers

**Is CVE-2026-119328 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119328 being exploited in the wild.

**How severe is CVE-2026-119328?** Medium severity, with a CVSS score of 6.5, published 30 October 2026.

**Which products and versions are affected?** Immich-App Immich before 3.3.0.

**Is there a fix for CVE-2026-119328?** Yes: fixed in 3.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119328 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-119328?** Check whether you run Immich-App Immich at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.3.0

## Technical details

The /predict endpoint in machine-learning/immich_ml/main.py accepts an options object and passes values directly to model construction without validating security-sensitive parameters like cache_dir. An attacker can set cache_dir to an arbitrary writable path, causing model downloads to write there and triggering shutil.rmtree() on attacker-controlled paths after certain model-loading failures. A model-name allowlist prevents arbitrary deserialization or code execution, limiting impact to filesystem operations.

## Affected products

- immich-app Immich before 3.3.0

## Timeline

- 2026-10-30: disclosed
- 2026-09-28: patched: Fix released in version 3.3.0

## References

- [https://github.com/immich-app/immich/commit/ab159b81182f26a8943f5dd66b719e8cdaad4626](https://github.com/immich-app/immich/commit/ab159b81182f26a8943f5dd66b719e8cdaad4626)
- [https://github.com/immich-app/immich/pull/31856](https://github.com/immich-app/immich/pull/31856)

## Related threats

- [Immich shared link password bypass in access control](https://junglewise.ai/threats/cve-2026-103532-a-vulnerability-has-been-found-in-immich-app-immich-up-to-2-7-5)