PT-2026-31431 · Imich · Imich

Published 2026-04-08 · Updated 2026-04-08 · CVE-2026-35455

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions imich versions prior to 2.7.0

Description A Stored Cross-Site Scripting (XSS) issue exists in the 360° panorama viewer. An authenticated user can execute arbitrary JavaScript in the browser of another user viewing a malicious panorama with the OCR overlay enabled. The attacker uploads an equirectangular image containing crafted text. OCR extracts the text, and the panorama viewer renders it using innerHTML without sanitization. This could lead to session hijacking (via persistent API key creation), private photo exfiltration, and access to GPS location history and face biometric data.

Recommendations Update to version 2.7.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-35455

Affected Products

Imich

References · 5

• 🔥 https://github.com/immich-app/immich/security/advisories/GHSA-9qx4-67jm-cc66 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-35455 · Security Note
• https://twitter.com/CVEnew/status/2041975583328833627 · Twitter Post
• https://twitter.com/aisafe_io/status/2041909957017084144 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2042024146939326480 · Twitter Post