The vulnerability in immich-app immich (CVE-2026-40096) is an improper neutralization of input during web page generation (CWE-79) combined with an open redirect (CWE-601). Specifically, the album name is inserted unsanitized into a <meta> tag in the api.service.ts file. A registered attacker can create a shared album with a specially crafted name containing a meta refresh directive that triggers a browser redirect to an attacker-controlled URL. This occurs in the <meta property="og:title"> tag, enabling phishing attacks by redirecting victims to malicious sites. The vulnerability affects versions prior to 2.7.3 and has been fixed in version 2.7.3.

Successful exploitation allows an attacker to redirect users who open a shared album link to a malicious website. This can be used to conduct phishing attacks by hosting fake login pages that steal user credentials. The vulnerability requires the attacker to be a registered user who can create shared albums. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low complexity, no privileges required beyond registration, and user interaction needed.

Upgrade immich to version 2.7.3 or later, where this vulnerability has been fixed. No other mitigation is required as the issue is resolved in the official patch.