https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 11:25:40 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-291460 EUVD-2026-291460 https://cve.radiocsirt.org/vuln/euvd-2026-291460 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40096 <p>immich is a high performance self-hosted photo and video management solution. Versions prior to 2.7.3 contain an open redirect vulnerability in the shared album functionality, where the album name is inserted unsanitized into a &lt;meta&gt; tag in api.service.ts. A registered attacker can create a shared album with a crafted name containing 0;url=https://attackersite.com&#34; http-equiv=&#34;refresh, which when rendered in the &lt;meta property=&#34;og:title&#34;&gt; tag causes the victim&#39;s browser to redirect to an attacker-controlled site upon opening the share link. This facilitates phishing attacks, as the attacker could host a modified version of immich that collects login credentials from victims who believe they need to authenticate to view the shared album. This issue has been fixed in version 2.7.3.</p> <p>immich is a high performance self-hosted photo and video management solution. Versions prior to 2.7.3 contain an open redirect vulnerability in the shared album functionality, where the album name is inserted unsanitized into a &lt;meta&gt; tag in api.service.ts. A registered attacker can create a shared album with a crafted name containing 0;url=https://attackersite.com&#34; http-equiv=&#34;refresh, which when rendered in the &lt;meta property=&#34;og:title&#34;&gt; tag causes the victim&#39;s browser to redirect to an attacker-controlled site upon opening the share link. This facilitates phishing attacks, as the attacker could host a modified version of immich that collects login credentials from victims who believe they need to authenticate to view the shared album. This issue has been fixed in version 2.7.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-40096