felhom.eu/documentation/audits/security-app-updates-2026-10-27/triage-notes/immich.md

immich — triage (pins immich-server:v3.2.4, immich-machine-learning:v3.2.4)

Template: setup_gate: true.

Notices

• GHSA-8244-8vpr-vp9c (CVE-2026-53662, critical, login-page continue XSS) — NOT-A-FINDING. Range is git-commit form (> main@4ffa26c9, patched > main@4eb1003); advisory text: "No tagged release is affected", bug only on main builds since 2026-04-15. Checked by hand via GitHub compare API: v3.2.4...4eb1003 = "behind" (fix commit 4eb100327e, "fix: disallow cross origin/non http protocols for continueUrl on login (#28706)", 2026-06-01) is an ANCESTOR of v3.2.4. Fix shipped before v3.0.0 (2026-07-02).
• release:v3.3.5 — REAL runtime fix (no GHSA): Node.js Oct-2026 security release + certifi CA bundle / python image digests after the eMudhra CA compromise. Upstream: "we don't believe this ... brings an immediate danger". Severity: unsure (runtime; Node Brotli RCE CVE-2026-111497 is in that Node release, exploit path in Immich not described). Login: n/a. Reachable: n/a (TLS trust + Node runtime).

Fix

No real GHSA. Optional runtime refresh: TARGET ghcr.io/immich-app/immich-server:v3.3.5 AND ghcr.io/immich-app/immich-machine-learning:v3.3.5 (both tags verified on ghcr; must move together). postgres (ghcr.io/immich-app/postgres:16-vectorchord0.4.3-pgvectors0.2.0) and redis:7-alpine: do NOT need to move — upstream docker/docker-compose.yml at v3.2.4 and v3.3.5 pins the identical postgres image (14-vectorchord0.4.3-pgvectors0.2.0, same digest) and valkey:9 in both. Same main (3): yes. Breaking: none found in 5 stable releases (v3.3.0, 3.3.1, 3.3.3, 3.3.4, 3.3.5) + 3 RCs; v3.3.0 ML model revision v2 is opt-in (MACHINE_LEARNING_MODEL_REVISION=v2), migrations self-run. Lane: NOT_A_FINDING for the GHSA; SECURITY_FIX (runtime) v3.3.5 if the operator wants the Node/CA refresh. Classifier note: GHSA ranges of form main@<sha> mean "untagged main builds" — treat as not affecting tagged pins unless the text says otherwise.