Executive brief
Immich is a self-hosted application used for managing personal photo and video collections. A security flaw in its 360-degree panorama viewer allows a malicious user to upload a specially crafted image that executes hidden code when viewed by others. If an administrator or another user views the image with the text-recognition (OCR) feature enabled, the attacker could steal their login session, access private photos, or view sensitive location and biometric data.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in Immich's 360° panorama viewer component (photo-sphere-viewer-adapter.svelte). The vulnerability occurs because the application uses the PaddleOCR pipeline to extract text from images and then renders that text using innerHTML without proper sanitization when the OCR overlay is enabled. An attacker can upload an equirectangular image containing malicious JavaScript; when another user views this panorama and interacts with the OCR tooltip, the script executes in their context. This can be used to bypass CSP (if 'unsafe-inline' is present) to create persistent API keys, exfiltrate private assets, or access GPS and biometric metadata. The issue is fixed in version 2.7.0.
Affected products
- immich-app immich >= 2.6.0, < 2.7.0
Timeline
- 2026-04-08: disclosed
- 2026-04-08: advisory
- 2026-04-08: patched: Fixed in version 2.7.0