CVE-2026-35455

CVE-2026-35455 is a Stored Cross-Site Scripting vulnerability in Immich, a self-hosted photo and video management platform, affecting versions prior to 2.7.0. The flaw exists in the 360-degree panorama viewer, where insufficient input sanitization allows authenticated users to inject malicious code that executes in other users' browsers when they view the compromised panorama with OCR overlay enabled. Attack delivery involves uploading an equirectangular image with crafted text that the OCR function extracts and renders unsanitized via innerHTML. The vulnerability carries a CVSS 3.1 score of 5.4 (Medium) with a network-based attack vector requiring low complexity and user interaction, but no elevated privileges. Successful exploitation enables significant impact including session hijacking through API key creation, exfiltration of private photos, and unauthorized access to sensitive data such as GPS location history and face biometric information. The EPSS probability is very low at 0.00026, suggesting minimal current exploitation likelihood. There is no evidence of active exploitation or public exploit code availability. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog, and community attention remains inactive. Organizations running Immich should prioritize upgrading to version 2.7.0 or later to remediate this risk, with particular attention to instances where OCR overlay functionality is enabled.