BSD Portsimmich -- multiple vulnerabilities
· CVE-2026-105764 · VuXML entry
The Immich project reports: An attacker-chosen OAuth state cookie allows forced account linking and takeover of any account, bypassing the fix for CVE-2025-43856. A malicious or intercepted server can read, exfiltrate and delete arbitrary local files through the duplicate check of the command line client. An external library import follows symbolic links, which allows arbitrary files to be read. Unsanitized EXIF …
Affected versions
- immich, immich-cli < 3.4.0
By system
0 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| FreeBSD | www/immich | 3.4.1_1 | fixed | |
| FreeBSD | www/immich-cli | 3.4.1 | fixed |