CVE-2026-35455

HighPublic PoC

Published: 08 April 2026

Published

08 April 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0003 8.6th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-35455 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Futo Immich. Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 8.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-15 (Information Output Filtering) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Browser Session Hijacking (T1185) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-15 Information Output Filtering good match

prevent

Directly addresses the stored XSS by requiring filtering of OCR-extracted text prior to rendering via innerHTML in the panorama viewer, preventing arbitrary JavaScript execution.

SI-10 Information Input Validation partial match

prevent

Validates information inputs from uploaded equirectangular images and OCR processing to reject or sanitize crafted malicious text payloads.

SI-2 Flaw Remediation good match

prevent

Ensures timely flaw remediation by applying patches such as Immich 2.7.0, which fixes the lack of sanitization in the vulnerable panorama viewer component.

MITRE ATT&CK Enterprise TechniquesAI

T1185 Browser Session Hijacking Collection

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

attack.mitre.org →

T1567 Exfiltration Over Web Service Exfiltration

Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel.

attack.mitre.org →

Why these techniques?

Stored XSS enables arbitrary JavaScript execution in victim's browser, directly facilitating browser session hijacking (via API key) and exfiltration of photos/data over web services.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

immich is a high performance self-hosted photo and video management solution. Prior to 2.7.0, sStored Cross-Site Scripting (XSS) in the 360° panorama viewer allows any authenticated user to execute arbitrary JavaScript in the browser of any other user who views…

the malicious panorama with the OCR overlay enabled. The attacker uploads an equirectangular image containing crafted text; OCR extracts it, and the panorama viewer renders it via innerHTML without sanitization. This enables session hijacking (via persistent API key creation), private photo exfiltration, and access to GPS location history and face biometric data. This vulnerability is fixed in 2.7.0.

Deeper analysisAI

CVE-2026-35455 is a stored cross-site scripting (XSS) vulnerability, classified under CWE-79, affecting Immich, a high-performance self-hosted photo and video management solution. The issue exists in versions prior to 2.7.0 within the 360° panorama viewer component, where OCR-extracted text from images is rendered via innerHTML without proper sanitization.

Any authenticated user can exploit the vulnerability by uploading an equirectangular image containing crafted text. When another user views the malicious panorama with the OCR overlay enabled, the extracted text triggers arbitrary JavaScript execution in the victim's browser. This enables session hijacking via persistent API key creation, exfiltration of private photos, and access to GPS location history and face biometric data. The CVSS v3.1 base score is 7.3 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H).

The vulnerability is fixed in Immich version 2.7.0. Additional details on mitigation are available in the GitHub security advisory at https://github.com/immich-app/immich/security/advisories/GHSA-9qx4-67jm-cc66.