20 lines
2.9 KiB
Plaintext
20 lines
2.9 KiB
Plaintext
GHSA-q89f-h332-8q2h 2026-09-28 high | Authenticated SVG upload reaches ImageMagick coders and enables RCE | docker:ghcr.io/immich-app/immich-server | v3.2.2 -> v3.2.4
|
|
GHSA-h5w4-vjv4-9r5q 2026-08-23 low | Incorrect sanitization of continue URL on the /maintenance endpoint | :immich-server | <= v3.1.0 -> None
|
|
GHSA-g4w3-c888-cr93 2026-10-19 low | A regular user can create SharedLink for album/asset belonging to another user through Cre | : | <=3.1.0 -> v3.2.0
|
|
GHSA-g82p-27g4-864h 2026-10-13 medium | Broken access control: GET /api/admin/users/{id}/calendar-heatmap is reachable by any auth | other:immich | >= 3.0.0, <= 3.0.3 ->
|
|
GHSA-72rm-x7xr-v679 2026-10-19 medium | Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) i | other:immich | <= 3.0.3 -> v3.3.0
|
|
GHSA-3mh5-gqfm-phgj 2026-10-19 medium | Cross-user disclosure of a user's Locked (hidden-vault) assets to a partner via timeline-b | other:immich (immich-app/immich) — server | <= 3.0.3 -> v3.1.0
|
|
GHSA-qp2h-w794-2vhf 2026-07-06 medium | Incomplete fix for login continue redirect allows slash-backslash open redirect | other:immich-app/immich | <= 2.7.5, and current main e2de8c7c536cac5a673a3aa60cc998815b62d247 after PR #28706 -> v3.0.0
|
|
GHSA-hv27-723h-qfjq 2026-10-19 medium | Partner "view-only" sharing leaks GPS coordinates of the sharer's archived assets via GET | immich-server:immich-server | <= v2.7.5 (current release) -> v3.0.0
|
|
GHSA-c9mf-h82r-8p4j 2026-10-19 high | Album Editor can escalate to Owner role and remove Owner-role members via unguarded API en | npm:immich | <= 3.0.0 -> v3.0.3
|
|
GHSA-8244-8vpr-vp9c 2026-06-01 critical | One-click account takeover via XSS in login page continue redirect | docker:immich-server | > main@4ffa26c9 -> > main@4eb1003
|
|
GHSA-hfvf-5c8x-8rc4 2026-07-06 medium | OIDC discovery/token/userinfo/JWKS fetches run with TLS certificate verification unconditi | npm:@immich/server | <=latest -> v3.0.0
|
|
GHSA-24fq-72x8-v7hm 2026-04-13 medium | Open Redirect via Shared Album name | docker:immich-server | < 2.7.3 -> >= 2.7.3
|
|
GHSA-jrp5-g662-hq92 2026-07-06 low | Unsafe ZIP Entry Names (Zip Slip Class) in Archive Download Endpoint | npm:immich | >2.6.2 -> 3.0.0
|
|
GHSA-9qx4-67jm-cc66 2026-04-08 high | Stored XSS via OCR Text in 360° Panorama Viewer | docker:immich-server | 2.6.x -> 2.7.0
|
|
GHSA-hq46-gw2v-q86p 2026-07-06 medium | SSRF via OAuth Profile Picture URL (CWE-918) | npm:@immich/server | <= 1.129.0 -> v3.0.0
|
|
GHSA-237r-x578-h5mv 2026-01-29 high | API Key Privilege Escalation | docker:immich-server | < 2.4.1 -> >= 2.5.0
|
|
GHSA-hvq7-hq9r-8gjr 2026-07-06 medium | [DCODX-AI] Shared-link authentication allows adding owner's assets to shared links (AssetS | : | <=2.1.0 -> v3.0.0
|
|
GHSA-78x4-6x83-jx75 2026-04-02 medium | Insecure transmission of shared link password | docker:immich-server | < v2.5.2 -> >= 2.6.0
|
|
GHSA-3832-6r8h-9cfm 2025-07-11 high | Account hijacking through oauth2 | docker:immich-server | < v1.132.0 -> >= v1.132.0
|