MediumVulnerability
CVE-2026-119328: Immich unauthenticated /predict endpoint allows arbitrary cache deletion
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-119328
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
Summary
Immich, a self-hosted photo and video manager, has an unauthenticated machine-learning /predict endpoint in machine-learning/immich_ml/main.py that passes caller-supplied options into model construction without restricting security-sensitive parameters. An attacker with network access could set cache_dir to an arbitrary writable path, causing model downloads to write there and clear_cache() to call shutil.rmtree() on that path after certain model-loading failures, which may modify mounted data or recursively delete an attacker-selected directory. The model-name allowlist prevents arbitrary-model deserialization or code execution.
Mitigation
Fixed in version 3.3.0.
Related items
- HighCVE-2026-63378: TAKO AI Agent for Okta code execution via execute-script endpointSimilar attack · NVD/CVE Database
- CriticalCVE-2026-63377: TAKO AI Agent for Okta unauthenticated admin account creation via setup endpointSimilar attack · NVD/CVE Database
- HighCVE-2026-119337: RAGFlow agent chat completions API bypasses access check on private agentsSimilar attack · NVD/CVE Database
- HighCVE-2026-119978: Flowise sandbox escape to OS command execution via node-custom-function endpointSimilar attack · NVD/CVE Database
- HighCVE-2026-61789: DBHub read-only SQL validation bypass on MySQL and MariaDB connectorsSimilar attack · NVD/CVE Database