Comfyui CVE-2026-6590

Exploitation requires valid authentication to ComfyUI (PR:L indicates authenticated user or lower-privileged account access). The attack is limited to read-only file access; attackers cannot modify, delete, or create files on the server. The endpoint must be network-accessible, but no special configuration or non-default settings are described as prerequisites - the vulnerability exists in the default Model Preview Endpoint functionality. Attackers are constrained by file system permissions of the ComfyUI process owner; files readable by the ComfyUI service can be accessed, but files with stricter permissions cannot. The vulnerability does NOT allow unauthenticated access; an attacker must first obtain or compromise valid ComfyUI credentials. Non-default configurations (such as restricting the Preview Endpoint to localhost-only or behind authentication layers beyond ComfyUI's built-in system) would limit real-world exploitability but are not standard deployments.

CVSS score of 4.3 with network attack vector and low complexity indicates a moderate baseline risk. However, several factors reduce real-world severity: the vulnerability requires authenticated access (PR:L), limiting the attack surface to users with valid credentials or account compromise, and the impact is read-only (Confidentiality:Low, Integrity:None, Availability:None), preventing direct data modification or service disruption. The presence of public exploit code (E:P) and VulDB reporting elevates practical risk, as malicious actors with credentials can now easily extract sensitive files. The vendor's non-response to early disclosure is concerning for timely patch availability. CVSS Environmental Score (RL:X, RC:R) reflects remediation uncertainty. This is a real but contextual priority: high-risk in multi-tenant or shared ComfyUI deployments where untrusted users have accounts, lower-risk in isolated or private installations. The authentication requirement significantly limits the attack surface compared to a remote unauthenticated equivalent.

An authenticated user with a valid ComfyUI account crafts a malicious request to the Model Preview Endpoint, injecting a path traversal payload such as '../../../etc/passwd' or similar sequences into the model preview parameter. The endpoint, failing to sanitize the path, resolves the traversal sequence and returns the contents of the target file. The attacker downloads sensitive files including configuration files (containing API keys or database credentials), model weights, or system information, potentially enabling further compromise or data exfiltration. Public exploit code (available on the referenced Gist) automates this process.