ComfyUI CVE-2026-92816

Exploitation requires a victim to load and execute an attacker-crafted ComfyUI workflow whose dataset save node supplies an unsanitized folder_name containing path-traversal sequences (reference: comfy_extras/nodes_dataset.py lines 303-318 in v0.24.0). No authentication is required (PR:N), but user interaction is mandatory (UI:P) - the attacker must convince the victim to import/run the malicious workflow. The condition is present in default configurations of affected versions (any ComfyUI before 0.30.0) that use the dataset save nodes; code execution is not immediate but follows once the written startup file or package initializer is loaded. The vendor scores this AV:L (local), which limits the raw vector, though network-exposed ComfyUI instances may widen delivery options.

This is a genuine priority for anyone running ComfyUI, though not an unauthenticated remote 'internet-worm' class flaw. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H, score 8.5) describes a locally-vectored, low-complexity, unauthenticated path traversal whose only meaningful gate is passive user interaction (UI:P) - a victim loading a crafted workflow. Technical impact is total (full C/I/A on the host via arbitrary file write leading to code execution through modified startup files or package initializers). A public POC exists (geo-chen/oss writeup) and a vendor patch is available, which raises real-world risk versus a theoretical bug. There is no CISA KEV listing and no EPSS score in the provided data, so status is 'publicly available exploit code exists' but NOT confirmed active exploitation - treat as high-likelihood-if-targeted rather than mass-exploited. One signal to verify: the vendor scored AV:L (local), but ComfyUI is frequently run as a network-exposed web service where a workflow could be delivered remotely - if the instance is reachable over the network, real-world attack surface is broader than AV:L implies; confirm the deployment exposure model.

An attacker publishes an attractive-looking ComfyUI workflow (e.g., on a model-sharing site or forum) whose dataset save node contains a folder_name with directory-traversal sequences pointing outside the output directory. When a victim imports and runs the workflow, ComfyUI writes attacker-controlled content to a sensitive location such as a Python startup file or package __init__.py, achieving code execution on next load. A public proof-of-concept demonstrating the traversal is available.