What is the CVSS score of CVE-2026-56673?

CVE-2026-56673 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of ComfyUI are affected by CVE-2026-56673?

ComfyUI versions before 0.28.0 contain a path traversal vulnerability enabling remote unauthenticated attackers to exfiltrate arbitrary files from the host system, presenting immediate…. A patch is available.

How to fix or mitigate CVE-2026-56673?

Within 24 hours: inventory all ComfyUI deployments and identify instances running versions prior to 0.28.0; immediately restrict network access to ComfyUI systems to authorized users and networks only, using firewall rules or VPN gating if operationally feasible. Within 7 days: implement Web Application Firewall rules to block path traversal patterns in /prompt workflow requests; audit access logs for exploitation attempts or suspicious file-read patterns; and document the sensitivity classification and accessibility of files in directories accessible to ComfyUI. Within 30 days: continuously monitor vendor advisory channels and the ComfyUI repository for patch release; conduct a pilot upgrade to version 0.28.0 or later on a non-production instance to validate compatibility; and establish a patching timeline for all production ComfyUI systems to deploy the patch immediately upon vendor release.

ComfyUI CVE-2026-56673

EUVD-2026-51403 HIGH

Path Traversal (CWE-22)

2026-07-31 GitHub_M

Path Traversal Comfyui Comfy Org

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network POST /prompt with no user interaction and low complexity yields confidentiality-only file disclosure; no integrity or availability impact, so I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 31, 2026 - 06:15 EUVD

Source Code Evidence Fetched

Jul 31, 2026 - 05:48 vuln.today

Analysis Generated

Jul 31, 2026 - 05:48 vuln.today

CVE Published

Jul 31, 2026 - 04:46 cve.org

HIGH 7.5

DescriptionCVE.org

ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node interface. Prior to 0.28.0, folder_paths.get_annotated_filepath and exists_annotated_filepath join workflow-controlled annotated filenames to a base directory without a containment check, allowing an unauthenticated crafted POST /prompt workflow using LoadImage or sibling nodes to probe arbitrary host paths and exfiltrate image-format files through /view. LoadImage defines a VALIDATE_INPUTS method, which causes the execution engine to skip COMBO (input-directory) validation. Affected nodes include LoadImage, LoadImageMask, LoadImageOutput, LoadAudio, LoadLatent, LoadVideo, and Load3D. This issue is fixed in version 0.28.0.

AnalysisAI

Path traversal arbitrary file read in ComfyUI (comfy-org) before 0.28.0 lets remote unauthenticated attackers probe arbitrary host filesystem paths and exfiltrate image-format files via the /view endpoint. A crafted POST /prompt workflow using LoadImage or sibling loader nodes joins attacker-controlled annotated filenames to a base directory with no containment check, and LoadImage's VALIDATE_INPUTS method causes the engine to skip input-directory validation. Rated CVSS 7.5 (confidentiality-only); no public exploit identified at time of analysis and it is not on CISA KEV.

Technical ContextAI

ComfyUI is a modular node/graph GUI and API backend for diffusion (Stable Diffusion) image generation, exposing an HTTP API where workflows are submitted as JSON. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): folder_paths.get_annotated_filepath and exists_annotated_filepath build a filesystem path by joining a workflow-supplied 'annotated' filename (which encodes a base directory such as input/output/temp) to a base directory without verifying the result stays inside that directory, so sequences like ../../ escape it. Compounding this, the LoadImage node declares a VALIDATE_INPUTS method, which signals the execution engine to bypass the normal COMBO validation that would otherwise restrict the value to entries actually present in the input directory. The fix in PR #14734 introduces a reusable folder_paths.is_within_directory() containment helper that realpaths both the base directory and target (also defeating symlink escape) and requires commonpath to equal the base directory; the same PR hardens the model-preview and userdata endpoints and adds is_dangerous_content_type() to force risky MIME types to download.

RemediationAI

Vendor-released patch: upgrade to ComfyUI 0.28.0 or later, which adds the folder_paths.is_within_directory() containment check per advisory GHSA-rvxv-29p8-pxgq (https://github.com/Comfy-Org/ComfyUI/security/advisories/GHSA-rvxv-29p8-pxgq) and PR #14734 (https://github.com/Comfy-Org/ComfyUI/pull/14734). If you cannot upgrade immediately, do not expose the ComfyUI API to untrusted networks: bind it to localhost or place it behind a reverse proxy or VPN that enforces authentication, and restrict or block unauthenticated access to the POST /prompt and GET /view endpoints, since these are the ingestion and exfiltration paths - the trade-off is that remote and multi-user workflow submission will be blocked. Run the ComfyUI process under a low-privilege account with a restricted filesystem view (for example a container or chroot) so that traversal reads reach as few sensitive files as possible, accepting the operational overhead of containerization. Avoid loading untrusted workflow JSON from third parties until patched.