Immich
Storage · products/immich.yaml · RSS
Latest 3.3.5 Oct 21, 2026
Recent releases
securitychore(deps): update python docker digests
securitychore(deps): update dependency certifi to v2026.10.19
breakingchore(mobile): drop support for iOS 14 by @agg23 in
securityFixes GHSA-jrp5-g662-hq92: Unsafe ZIP Entry Names (Zip Slip Class) in Archive Download Endpoint
breakingrefactor!: migrate class-validator to zod
breakingrefactor!: remove replace asset
Security advisories
8.8 CVE-2026-77439 Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints
3.5 GHSA-g4w3-c888-cr93 A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API
6.5 GHSA-72rm-x7xr-v679 Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service
6.5 GHSA-3mh5-gqfm-phgj Cross-user disclosure of a user's Locked (hidden-vault) assets to a partner via timeline-bucket and search-statistics endpoints
4.3 GHSA-hv27-723h-qfjq Partner "view-only" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers (the map endpoint omits the archived-asset guard the timeline endpoint enforces)
4.3 CVE-2026-104867 Broken access control: GET /api/admin/users/{id}/calendar-heatmap is reachable by any authenticated non-admin user (cross-user activity/asset-count disclosure, includes archived and locked assets)
4.7 GHSA-hfvf-5c8x-8rc4 OIDC discovery/token/userinfo/JWKS fetches run with TLS certificate verification unconditionally disabled via allowInsecureRequests (CWE-295)
6.1 GHSA-qp2h-w794-2vhf Incomplete fix for login continue redirect allows slash-backslash open redirect
6.9 GHSA-hvq7-hq9r-8gjr [DCODX-AI] Shared-link authentication allows adding owner's assets to shared links (AssetShare authorization bypass)