CVE-2026-119328

Immich ML options allow filesystem path injection

Immich · Immich machine-learning service

First documented disclosure · Review checkpoint

Summary

An exposed ML endpoint can be directed to write model files into, or recursively delete, an attacker-selected writable directory.

Severity and exploitation evidence

Medium · 6.5/10 · CVSS 3.1. Severity source.

Exploitation not established: Controlled research or code-path evidence; the reviewed sources do not establish malicious exploitation or a confirmed victim.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The predict endpoint passed unvalidated options into a model constructor. A caller-controlled cache_dir became the download target and the path deleted on specified model-load failures.

Conditions required

Network access to the ML service and a target path writable by its process; deletion additionally requires a load failure reaching cache cleanup.

Potential impact

Filesystem integrity loss and denial of service within the service permissions and mounts. The allowlisted model mapping does not permit arbitrary-model deserialization by this path.

Affected versions and configurations

CNA: before 3.3.0. The advisory confirms the path on 3.0.3 and its package table lists through 3.0.3; the broader CNA range is retained with that distinction.

Fix and mitigation status

3.3.0 contains request validation for this issue; use a current supported release.

Practical next steps

Upgrade and keep the ML service on a restricted internal network. Limit writable mounts and reject request options that control internal cache paths or model-loading settings.

Operating lesson

Inference parameters should not expose internal storage and cleanup controls.

Evidence and limits

Public validation PR #31856 on September 28 described forwarding internal options; fix release October 7; detailed vulnerability advisory October 19; CVE October 30. Maintainer/CNA score is Medium 6.5 CVSS 3.1; the original report proposes High 8.6. No arbitrary-model RCE is established.

Sources