XSS in Futo Immich
CVE-2026-40096
immich is a high performance self-hosted photo and video management solution. Versions prior to 2.7.3 contain an open redirect vulnerability in the shared album functionality, where the album name is inserted unsanitized into a <meta> tag in api.service.ts. A registered attacker can create a shared album with a crafted name containing 0;url=https://attackersite.com" http-equiv="refresh, which when rendered in the <meta property="og:title"> tag causes the victim's browser to redirect to an attacker-controlled site upon opening the share link. This facilitates phishing attacks, as the attacker could host a modified version of immich that collects login credentials from victims who believe they need to authenticate to view the shared album. This issue has been fixed in version 2.7.3.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.002 (11.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Futo Immich
- Immich-app Immich — versions < 2.7.3
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
- security-advisories@github.com (Product, x_refsource_MISC, Release Notes)
Frequently asked questions
- What is CVE-2026-40096?
- CVE-2026-40096 is a medium-severity vulnerability in Futo Immich, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2026-04-15.
- How severe is CVE-2026-40096?
- Medium severity. CVSS v3 base score is 5.4 out of 10.