EUVD-2026-51401Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network traversal with low complexity (PR:N/AC:L/AV:N) yields file/host-path disclosure (C:H) but no write or availability impact (I:N/A:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, get_model_preview in app/model_manager.py joins an unrestricted filename route capture to a selected model directory without a containment check, allowing an unauthenticated remote attacker to use traversal, encoded traversal, absolute paths, or an unbounded path_index to read image-decodable files and enumerate host paths. get_model_preview (app/model_manager.py) built the path with os.path.join(folder, filename) where filename is an unrestricted {filename:.*} route capture. Literal ../, percent-encoded %2e%2e%2f, and absolute paths all escaped the model directory; path_index was also unbounded. The target file is piped through Pillow and re-encoded as WEBP, so disclosure is limited to image-decodable files plus a file-existence/enumeration oracle (and internal-path leakage via path_index errors). This issue is fixed in version 0.28.0.
AnalysisAI
Unauthenticated information disclosure in ComfyUI (comfy-org/comfyui) before 0.28.0 lets remote attackers read arbitrary image-decodable files and enumerate the host filesystem via the get_model_preview endpoint, which joins an unrestricted {filename:.*} route capture to the model directory with no containment check (CWE-22). Attackers can use literal ../, percent-encoded %2e%2e%2f, absolute paths, or an unbounded path_index to escape the model folder; disclosure is bounded to files Pillow can decode plus a file-existence/path-enumeration oracle. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network access to ComfyUI's built-in web server and a reachable model preview request handled by get_model_preview in app/model_manager.py on any version before 0.28.0 - no authentication, credentials, or user interaction are needed (AV:N/AC:L/PR:N/UI:N against default configurations, since ComfyUI ships without authentication). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) indicates a network-reachable, low-complexity, unauthenticated read primitive with no integrity or availability impact - consistent with the description of an unauthenticated remote traversal oracle. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote attacker who can reach the ComfyUI HTTP interface sends a crafted request to the model preview endpoint with a filename such as ../../../../ or an absolute path, using literal or percent-encoded traversal, to enumerate host directories and read any image-decodable file outside the model folder. By observing successful WEBP responses versus errors (including path_index error messages), the attacker maps the filesystem and confirms file existence. … |
| Remediation | Vendor-released patch: upgrade to ComfyUI 0.28.0 or later (https://github.com/Comfy-Org/ComfyUI/releases/tag/v0.28.0), which adds path normalization and a realpath-based is_within_directory() containment check in app/model_manager.py plus validation of the filename and path_index parameters; see advisory GHSA-pj59-g5vv-74q4 and PR #14734. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all ComfyUI deployments and identify those running versions before 0.28.0; if any are internet-facing, restrict network access immediately. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
comfyanonymous/comfyui version v0.2.4 suffers from a non-blind Server-Side Request Forgery (SSRF) vulnerability. Rated h
A stored cross-site scripting (XSS) vulnerability exists in comfyanonymous/comfyui version 0.2.2 and possibly earlier. R
Remote code execution in ComfyUI v0.23.0 (and all prior 0.x releases) lets unauthenticated attackers run arbitrary Pytho
Stored cross-site scripting in ComfyUI before 0.28.0 lets an attacker upload a malicious SVG that the /view endpoint ser
Stored cross-site scripting in ComfyUI (Comfy-Org) before 0.28.0 lets an attacker upload HTML or SVG to the per-user use
Path traversal arbitrary file read in ComfyUI (comfy-org) before 0.28.0 lets remote unauthenticated attackers probe arbi
Path traversal in ComfyUI up to version 0.13.0 allows authenticated remote attackers to read arbitrary files on the serv
Path traversal in ComfyUI up to version 0.13.0 allows authenticated remote attackers to read arbitrary files via manipul
Cross-site request forgery (CSRF) in ComfyUI up to version 0.13.0 allows unauthenticated remote attackers to modify appl
Cross-site scripting (XSS) in ComfyUI up to version 0.13.0 allows authenticated remote attackers to inject malicious scr
Stored cross-site scripting (XSS) in ComfyUI's userdata endpoint (getuserdata function in app/user_manager.py) allows au
A CSRF vulnerability exists in comfyanonymous/comfyui versions up to v0.2.2. Rated medium severity (CVSS 6.5), this vuln
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today