A flaw in Immich’s thumbnail‑generation pipeline allows an authenticated non‑admin user to upload specially crafted SVG files. When the server processes these files with libvips, some SVGs bypass the native loader and are passed to ImageMagick. Untrusted <image href> values then reach ImageMagick’s MSL and VIDEO coders, enabling execution of arbitrary commands within the Immich‑server container. The vulnerability is a classic code injection (CWE‑94) and can compromise confidentiality, integrity, and availability of the host system.

The vulnerability affects all instances of Immich prior to version 3.2.4. This includes every self‑hosted deployment of immich-app:immich that has not applied the update released in the 3.2.4 tag.

The CVSS score of 7.7 indicates a high severity impact. Because the EPSS score is not available, the exact likelihood of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need legitimate user credentials but do not require administrative rights, making the exposure wide. The exploitation path involves creating a malicious SVG, storing it, and then referencing it from a second SVG that triggers thumbnail processing. Successful exploitation results in arbitrary code execution inside the container.