CVE-2026-105764: Immich Self-Hosted RCE Vulnerability

CVE-2026-105764 Overview

Immich is a self-hosted photo and video management platform. A code injection vulnerability (CWE-94) in versions prior to 3.2.4 allows authenticated non-admin users to achieve remote code execution inside the immich-server container. The flaw resides in the thumbnail-generation path in server/src/repositories/media.repository.ts, which passes uploaded SVG files to libvips. Crafted SVGs bypass the native libvips SVG loader and fall through to ImageMagick, where attacker-controlled <image href> values reach unrestricted MSL and VIDEO coder operations. The maintainers released version 3.2.4 to fix the issue.

Critical Impact

An authenticated low-privileged user can execute arbitrary code inside the immich-server container by uploading two crafted SVG assets that trigger ImageMagick MSL/VIDEO coder execution during thumbnail processing.

Affected Products

• Immich self-hosted photo and video management server
• All versions prior to 3.2.4
• Deployments using the default thumbnail-generation pipeline (libvips with ImageMagick fallback)

Discovery Timeline

• 2026-10-06 - CVE-2026-105764 published to the National Vulnerability Database (NVD)
• 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105764

Vulnerability Analysis

The vulnerability chains together assumptions in Immich's thumbnail pipeline and ImageMagick's permissive coder set. Immich accepts SVG uploads from authenticated users and routes them to libvips for rendering. When a file does not match the native SVG loader signature, libvips delegates processing to ImageMagick.

ImageMagick interprets the delegated file through its generic image coders. The MSL (Magick Scripting Language) and VIDEO coders accept external references, including <image href> attributes, without restriction. An attacker who stores one crafted asset and references its path from a second delayed-marker SVG can drive ImageMagick into executing attacker-controlled instructions. The code runs with the privileges of the immich-server process inside its container.

Root Cause

The root cause is unsafe delegation of untrusted SVG content to ImageMagick without a hardened policy.xml that disables the MSL, VIDEO, and similar coders. The thumbnail code in server/src/repositories/media.repository.ts did not constrain the fallback path, and the deployed ImageMagick configuration permitted scripting coders that execute arbitrary commands.

Attack Vector

Exploitation requires an authenticated non-admin account with upload permission. The attacker uploads a benign-looking asset to establish a known server-side path, then uploads a second SVG that uses delayed-marker syntax and references the first asset via <image href>. When Immich generates thumbnails, ImageMagick evaluates the referenced content through the MSL or VIDEO coder, executing attacker-controlled operations in the container. No user interaction beyond the upload is required.

// No verified exploit code is published. See the
// GHSA-q89f-h332-8q2h advisory for coordinated technical details.

Detection Methods for CVE-2026-105764

Indicators of Compromise

• Uploaded assets with the .svg extension that contain <image href="..."> elements referencing local file paths inside the Immich upload directory
• SVG files containing MSL directives or delayed-marker constructs processed by the thumbnail worker
• Unexpected child processes spawned by the immich-server or ImageMagick process trees, such as shells, curl, or wget
• Outbound network connections initiated by the immich-server container to attacker-controlled infrastructure during thumbnail generation

Detection Strategies

• Inspect SVG uploads for <image href> attributes that resolve to server-local paths rather than remote HTTPS resources
• Monitor the immich-server container for process executions outside the expected Node.js and media-processing binaries
• Correlate thumbnail-generation events in Immich logs with new processes, file writes outside the upload directory, or egress traffic

Monitoring Recommendations

• Enable container runtime telemetry to capture process, file, and network events from immich-server
• Alert on execution of ImageMagick coders such as MSL, VIDEO, EPHEMERAL, or HTTPS inside the container
• Review authentication logs for recently created low-privileged accounts that have uploaded SVG assets

How to Mitigate CVE-2026-105764

Immediate Actions Required

• Upgrade Immich to version 3.2.4 or later as published in the GitHub release notes
• Audit user accounts and revoke upload privileges for untrusted or unused non-admin users
• Review stored SVG assets for suspicious <image href> references and delayed-marker constructs

Patch Information

The fix is included in Immich version 3.2.4. Details are published in the GitHub Security Advisory GHSA-q89f-h332-8q2h. Operators running container deployments should pull the updated image, redeploy the stack, and verify the version in the admin interface.

Workarounds

• Block or reject SVG uploads at a reverse proxy or application gateway until the patched version is deployed
• Harden the ImageMagick policy.xml inside the container to disable MSL, VIDEO, EPHEMERAL, HTTPS, URL, and MVG coders
• Restrict outbound network access from the immich-server container to limit the impact of successful exploitation

# Example ImageMagick policy hardening (policy.xml)
# <policy domain="coder" rights="none" pattern="MSL" />
# <policy domain="coder" rights="none" pattern="VIDEO" />
# <policy domain="coder" rights="none" pattern="EPHEMERAL" />
# <policy domain="coder" rights="none" pattern="HTTPS" />
# <policy domain="coder" rights="none" pattern="URL" />
# <policy domain="coder" rights="none" pattern="MVG" />