The vulnerability allows a registered attacker to create a shared album whose name contains a crafted meta tag that triggers a browser redirect to an arbitrary URL. When a victim opens the share link, the unsanitized album name is inserted into an og:title meta tag, causing the victim’s browser to navigate to the attacker‑controlled site. The attacker can then present a counterfeit version of immich to harvest credentials, enabling phishing attacks.

This flaw exists in the immich self‑hosted photo and video management solution, specifically in all versions before 2.7.3 of immich-app:immich. No post‑2.7.3 releases are affected.

The CVSS score of 5.1 indicates moderate risk; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack requires the victim to open a crafted shared album link, an action that can be achieved via email or messaging. The attacker’s ability to create such a link is limited to registered users, but once the link is exposed, victims can be redirected without authentication prompts, facilitating phishing and credential theft.