EUVD-2026-51403Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network POST /prompt with no user interaction and low complexity yields confidentiality-only file disclosure; no integrity or availability impact, so I:N/A:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node interface. Prior to 0.28.0, folder_paths.get_annotated_filepath and exists_annotated_filepath join workflow-controlled annotated filenames to a base directory without a containment check, allowing an unauthenticated crafted POST /prompt workflow using LoadImage or sibling nodes to probe arbitrary host paths and exfiltrate image-format files through /view. LoadImage defines a VALIDATE_INPUTS method, which causes the execution engine to skip COMBO (input-directory) validation. Affected nodes include LoadImage, LoadImageMask, LoadImageOutput, LoadAudio, LoadLatent, LoadVideo, and Load3D. This issue is fixed in version 0.28.0.
AnalysisAI
Path traversal arbitrary file read in ComfyUI (comfy-org) before 0.28.0 lets remote unauthenticated attackers probe arbitrary host filesystem paths and exfiltrate image-format files via the /view endpoint. A crafted POST /prompt workflow using LoadImage or sibling loader nodes joins attacker-controlled annotated filenames to a base directory with no containment check, and LoadImage's VALIDATE_INPUTS method causes the engine to skip input-directory validation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the ComfyUI HTTP API and the ability to submit a workflow via POST /prompt using one of the loader nodes (LoadImage, LoadImageMask, LoadImageOutput, LoadAudio, LoadLatent, LoadVideo, Load3D) with an attacker-controlled annotated filename; no authentication is needed (PR:N) and no user interaction is required (UI:N) against default configurations prior to 0.28.0. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N describes a low-complexity, network-reachable, unauthenticated attack with high confidentiality impact and no integrity or availability impact - internally consistent with the description. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach a ComfyUI instance's HTTP API sends a crafted POST /prompt containing a workflow whose LoadImage (or LoadImageOutput/Load3D) node supplies an annotated filename with ../ traversal sequences pointing outside the input directory. Because VALIDATE_INPUTS causes the engine to skip input-directory validation and no containment check is applied, the server resolves and loads the out-of-scope path, and the attacker then retrieves the rendered image bytes via GET /view to exfiltrate or confirm the existence of arbitrary host files. … |
| Remediation | Vendor-released patch: upgrade to ComfyUI 0.28.0 or later, which adds the folder_paths.is_within_directory() containment check per advisory GHSA-rvxv-29p8-pxgq (https://github.com/Comfy-Org/ComfyUI/security/advisories/GHSA-rvxv-29p8-pxgq) and PR #14734 (https://github.com/Comfy-Org/ComfyUI/pull/14734). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all ComfyUI deployments and identify instances running versions prior to 0.28.0; immediately restrict network access to ComfyUI systems to authorized users and networks only, using firewall rules or VPN gating if operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
comfyanonymous/comfyui version v0.2.4 suffers from a non-blind Server-Side Request Forgery (SSRF) vulnerability. Rated h
A stored cross-site scripting (XSS) vulnerability exists in comfyanonymous/comfyui version 0.2.2 and possibly earlier. R
Remote code execution in ComfyUI v0.23.0 (and all prior 0.x releases) lets unauthenticated attackers run arbitrary Pytho
Stored cross-site scripting in ComfyUI before 0.28.0 lets an attacker upload a malicious SVG that the /view endpoint ser
Stored cross-site scripting in ComfyUI (Comfy-Org) before 0.28.0 lets an attacker upload HTML or SVG to the per-user use
Unauthenticated information disclosure in ComfyUI (comfy-org/comfyui) before 0.28.0 lets remote attackers read arbitrary
Path traversal in ComfyUI up to version 0.13.0 allows authenticated remote attackers to read arbitrary files on the serv
Path traversal in ComfyUI up to version 0.13.0 allows authenticated remote attackers to read arbitrary files via manipul
Cross-site request forgery (CSRF) in ComfyUI up to version 0.13.0 allows unauthenticated remote attackers to modify appl
Cross-site scripting (XSS) in ComfyUI up to version 0.13.0 allows authenticated remote attackers to inject malicious scr
Stored cross-site scripting (XSS) in ComfyUI's userdata endpoint (getuserdata function in app/user_manager.py) allows au
A CSRF vulnerability exists in comfyanonymous/comfyui versions up to v0.2.2. Rated medium severity (CVSS 6.5), this vuln
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today