The immich photo and video management application versions before 2.7.3 have an XSS vulnerability (CWE-79) caused by unsanitized input in the shared album name, which is inserted into a <meta property="og:title"> tag in api.service.ts. An attacker can exploit this by creating a shared album with a specially crafted name containing a meta refresh directive that causes the victim's browser to redirect to a malicious site. This vulnerability enables phishing attacks by redirecting users to attacker-controlled pages that may mimic immich login screens. The vulnerability is tracked as CVE-2026-40096 with a CVSS 4.0 base score of 5.1 (medium severity). The issue was resolved in immich version 2.7.3.

Successful exploitation results in victim browsers being redirected to attacker-controlled websites when opening shared album links, facilitating phishing attacks. This can lead to credential theft if victims are tricked into entering login information on fake pages. The vulnerability requires a registered attacker to create a malicious shared album and user interaction to open the link. There is no indication of remote code execution or system compromise beyond phishing facilitation.

Upgrade immich to version 2.7.3 or later, where this vulnerability has been fixed. Since this is a self-hosted application, administrators should apply the update promptly to prevent exploitation. No additional mitigations are specified or required once the update is applied.