CVE-2026-35455

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-35455

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35455.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-35455

Aliases

GHSA-9qx4-67jm-cc66

Published

2026-04-08T18:31:27.418Z

Modified

2026-07-27T03:56:13.486189997Z

Severity

7.3 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

immich has Stored XSS via OCR Text in 360° Panorama Viewer

Details

immich is a high performance self-hosted photo and video management solution. Prior to 2.7.0, sStored Cross-Site Scripting (XSS) in the 360° panorama viewer allows any authenticated user to execute arbitrary JavaScript in the browser of any other user who views the malicious panorama with the OCR overlay enabled. The attacker uploads an equirectangular image containing crafted text; OCR extracts it, and the panorama viewer renders it via innerHTML without sanitization. This enables session hijacking (via persistent API key creation), private photo exfiltration, and access to GPS location history and face biometric data. This vulnerability is fixed in 2.7.0.

Database specific

{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35455.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/immich-app/immich

Affected ranges

Type

GIT

Repo

https://github.com/immich-app/immich

Events

Introduced

f413f5c6923ff6fae26248af9987f0036e87a735

Fixed

afec61addcbb14b54cb5dcc9dd7c8a101a6b72f3

Database specific

{
    "cpe": "cpe:2.3:a:futo:immich:*:*:*:*:*:docker:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.7.0"
        },
        {
            "introduced": "2.6.0"
        }
    ]
}

Affected versions

v2.*

v2.6.0

v2.6.1

v2.6.2

v2.6.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35455.json"