Comfyui CVE-2026-6591

The vulnerability requires authenticated access to a ComfyUI instance (PR:L). The attacker must have valid credentials or compromise a legitimate user account to interact with the LoadImage Node via the API or web interface. The LoadImage Node must be available and functional in the deployment. No special configuration is required - the vulnerability is present in default ComfyUI installations up to version 0.13.0. The attack is limited to confidentiality of files accessible to the ComfyUI process user; data exfiltration relies on successful path traversal and the ability to read file contents, not modify or delete them. Systems with properly configured filesystem permissions that restrict the ComfyUI process to a minimal set of directories may mitigate the practical impact, though the underlying vulnerability remains.

The CVSS score of 4.3 reflects a low-to-moderate risk profile with a network attack vector, low complexity, and low privileges required (PR:L), limiting scope to the confidentiality of files. However, CVSS does not capture the full risk context: the publicly available exploit code (POC=YES) significantly increases real-world exploitation likelihood. The EPSS metric is not provided, preventing probabilistic exploitation assessment. The 'E:P' notation in the vector (Exploit: Proof-of-Concept) and 'RL:X' (Release Level: Unavailable) suggest the vendor has not released a patch. The requirement for authenticated access (PR:L) substantially limits attack surface compared to unauthenticated vulnerabilities, as attackers must first gain valid credentials or compromise a legitimate user. The confidentiality-only impact (C:L/I:N/A:N) means data exfiltration is possible but system integrity and availability remain protected. Real-world priority depends on deployment context: in air-gapped or internally-hosted ComfyUI instances with restricted user access, risk is lower; in shared SaaS or multi-tenant deployments, risk is elevated due to easier credential compromise.

An authenticated user or attacker with valid ComfyUI credentials crafts a malicious request to the LoadImage Node, injecting a path traversal sequence (e.g., '../../../etc/passwd') into the Name argument. The vulnerable folder_paths.get_annotated_filepath function fails to sanitize this input and resolves the path to a sensitive file outside the intended image directory, allowing the attacker to read the file contents and exfiltrate sensitive data such as configuration files, API keys, or source code.