Vulnerability · Published Apr 14, 2026 · Assigned by GitHub_M

CVE-2026-40096immich: Open Redirect via Shared Album name

Medium 5.1

In plain English

A medium-severity cross-site scripting in immich from immich-app. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.2%top 89.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

immich is a high performance self-hosted photo and video management solution. Versions prior to 2.7.3 contain an open redirect vulnerability in the shared album functionality, where the album name is inserted unsanitized into a <meta> tag in api.service.ts. A registered attacker can create a shared album with a crafted name containing 0;url=https://attackersite.com" http-equiv="refresh, which when rendered in the <meta property="og:title"> tag causes the victim's browser to redirect to an attacker-controlled site upon opening the share link. This facilitates phishing attacks, as the attacker could host a modified version of immich that collects login credentials from victims who believe they need to authenticate to view the shared album. This issue has been fixed in version 2.7.3.

Affected products (as reported)

Vendor	Product	Versions
immich-app	immich	< 2.7.3

Weakness: CWE-79, CWE-601 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/immich-app/immich/security/advisories/GHSA-24fq-72x8-v7hm x_refsource_CONFIRM
https://github.com/immich-app/immich/releases/tag/v2.7.3 x_refsource_MISC