CVE-2026-35455

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35455", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-02T19:25:52.193Z", "datePublished": "2026-04-08T18:31:27.418Z", "dateUpdated": "2026-04-13T15:36:26.045Z"}, "containers": {"cna": {"title": "immich has Stored XSS via OCR Text in 360\u00b0 Panorama Viewer", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/immich-app/immich/security/advisories/GHSA-9qx4-67jm-cc66", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/immich-app/immich/security/advisories/GHSA-9qx4-67jm-cc66"}], "affected": [{"vendor": "immich-app", "product": "immich", "versions": [{"version": "< 2.7.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-08T18:31:27.418Z"}, "descriptions": [{"lang": "en", "value": "immich is a high performance self-hosted photo and video management solution. Prior to 2.7.0, sStored Cross-Site Scripting (XSS) in the 360\u00b0 panorama viewer allows any authenticated user to execute arbitrary JavaScript in the browser of any other user who views the malicious panorama with the OCR overlay enabled. The attacker uploads an equirectangular image containing crafted text; OCR extracts it, and the panorama viewer renders it via innerHTML without sanitization. This enables session hijacking (via persistent API key creation), private photo exfiltration, and access to GPS location history and face biometric data. This vulnerability is fixed in 2.7.0."}], "source": {"advisory": "GHSA-9qx4-67jm-cc66", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-10T03:55:34.964312Z", "id": "CVE-2026-35455", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T15:36:26.045Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35455", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-10T03:55:34.964312Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T14:17:55.975Z"}}], "cna": {"title": "immich has Stored XSS via OCR Text in 360\u00b0 Panorama Viewer", "source": {"advisory": "GHSA-9qx4-67jm-cc66", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "immich-app", "product": "immich", "versions": [{"status": "affected", "version": "< 2.7.0"}]}], "references": [{"url": "https://github.com/immich-app/immich/security/advisories/GHSA-9qx4-67jm-cc66", "name": "https://github.com/immich-app/immich/security/advisories/GHSA-9qx4-67jm-cc66", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "immich is a high performance self-hosted photo and video management solution. Prior to 2.7.0, sStored Cross-Site Scripting (XSS) in the 360\u00b0 panorama viewer allows any authenticated user to execute arbitrary JavaScript in the browser of any other user who views the malicious panorama with the OCR overlay enabled. The attacker uploads an equirectangular image containing crafted text; OCR extracts it, and the panorama viewer renders it via innerHTML without sanitization. This enables session hijacking (via persistent API key creation), private photo exfiltration, and access to GPS location history and face biometric data. This vulnerability is fixed in 2.7.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-08T18:31:27.418Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35455", "state": "PUBLISHED", "dateUpdated": "2026-04-13T15:36:26.045Z", "dateReserved": "2026-04-02T19:25:52.193Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-08T18:31:27.418Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "immich", "vendor": "immich-app", "versions": [{"status": "affected", "version": "< 2.7.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:futo:immich:*:*:*:*:*:docker:*:*", "matchCriteriaId": "5BBDC371-C8D3-4FE4-B132-DFC88F0D1741", "versionEndExcluding": "2.7.0", "versionStartIncluding": "2.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "immich is a high performance self-hosted photo and video management solution. Prior to 2.7.0, sStored Cross-Site Scripting (XSS) in the 360\u00b0 panorama viewer allows any authenticated user to execute arbitrary JavaScript in the browser of any other user who views the malicious panorama with the OCR overlay enabled. The attacker uploads an equirectangular image containing crafted text; OCR extracts it, and the panorama viewer renders it via innerHTML without sanitization. This enables session hijacking (via persistent API key creation), private photo exfiltration, and access to GPS location history and face biometric data. This vulnerability is fixed in 2.7.0."}, {"lang": "es", "value": "immich es una soluci\u00f3n de gesti\u00f3n de fotos y videos autoalojada de alto rendimiento. Antes de la versi\u00f3n 2.7.0, un cross-site scripting (XSS) almacenado en el visor de panoramas de 360\u00b0 permite a cualquier usuario autenticado ejecutar JavaScript arbitrario en el navegador de cualquier otro usuario que vea el panorama malicioso con la superposici\u00f3n de OCR habilitada. El atacante sube una imagen equirectangular que contiene texto manipulado; el OCR lo extrae, y el visor de panoramas lo renderiza a trav\u00e9s de innerHTML sin sanitizaci\u00f3n. Esto permite el secuestro de sesi\u00f3n (mediante la creaci\u00f3n persistente de claves API), la exfiltraci\u00f3n de fotos privadas y el acceso al historial de ubicaci\u00f3n GPS y a los datos biom\u00e9tricos faciales. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.7.0."}], "id": "CVE-2026-35455", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35455", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-10T03:55:34.964312Z", "version": "2.0.3"}}]}, "published": "2026-04-08T19:25:24.357", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/immich-app/immich/security/advisories/GHSA-9qx4-67jm-cc66"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.7.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "immich", "source": "cna", "vendor": "immich-app"}, "product": "immich", "vendor": "immich-app"}], "analysis": {"en": {"generated_at": "2026-04-08T20:35:39.759801+00:00", "value": {"mitigation_remediation": ["Upgrade immich to version 2.7.0 or later to remove the flaw", "If an upgrade is not immediately feasible, disable the OCR overlay in the panorama viewer to prevent malicious text rendering", "Monitor user activity for abnormal API key creation or data exfiltration patterns"], "summary": {"action": "Patch Now", "impact": "Stored Cross\u2011Site Scripting that permits arbitrary JavaScript execution, enabling session hijacking, private photo exfiltration, and GPS and biometric data leaks"}, "threat_synthesis": {"affected_systems": "Any installation of immich that is running a version earlier than 2.7.0 is affected. The vulnerability is reported for the immich-app:immich product line and impacts all customers deploying those versions.", "description_and_impact": "immich, a self\u2011hosted photo and video management platform, suffered from a stored cross\u2011site scripting flaw in its 360\u00b0 panorama viewer. An authenticated user can upload an equirectangular image containing specially crafted text; the built\u2011in OCR engine extracts this text and the viewer renders it via innerHTML without sanitization. This allows the attacker to execute arbitrary JavaScript in the browser of any other user who opens the malicious panorama, potentially hijacking sessions through persistent API keys and exposing sensitive information such as private photos, GPS history, and face biometric data.", "risk_and_exploitability": "The vulnerability has a CVSS score of 7.3, indicating a high severity level. While an EPSS score is not publicly available and the flaw is not listed in the CISA KEV catalog, the attack requires an authenticated account to upload a malicious image and a second authenticated user to view it with OCR enabled. Consequently the exposed attack vector is an authenticated, yet internal, user flow that can be exploited to execute JavaScript and obtain further privileged data. Given the high CVSS score and the potential for extensive data loss and session compromise, the risk of exploitation is considered significant for affected deployments."}}}}, "created": "2026-04-09T08:18:23.027265+00:00", "updated": "2026-04-09T08:27:45.523420+00:00", "vendors": ["immich-app", "immich-app$PRODUCT$immich"]}