immich -- open redirect and reflected XSS in maintenance endpoint

2026-09-11 · VuXML entry

The immich project reports: The /maintenance endpoint fails to validate the continue URL parameter. When maintenance mode is disabled, which is the default, the application accepts unvalidated redirect targets, enabling both open redirects and reflected cross-site scripting. An unauthenticated user can craft a malicious link leading to account takeover, including administrative accounts, through same-origin API …

Affected versions

• immich < 3.2.0

By system

0 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.