What is the CVSS score of EUVD-2026-51401?

EUVD-2026-51401 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.7%.

Which versions of ComfyUI are affected by EUVD-2026-51401?

ComfyUI versions before 0.28.0 contain an unauthenticated path traversal vulnerability allowing remote attackers to read arbitrary files and enumerate the host filesystem without authentication.. A patch is available.

How to fix or mitigate EUVD-2026-51401?

Within 24 hours, inventory all ComfyUI deployments and identify those running versions before 0.28.0; if any are internet-facing, restrict network access immediately. Within 7 days, test ComfyUI version 0.28.0 in a non-production environment, then deploy to all affected systems; concurrently review access logs for suspicious requests to the get_model_preview endpoint containing path traversal patterns (../, %2e%2e%2f, absolute paths). Within 30 days, verify all instances are running 0.28.0 or later, complete any deferred deployments, and conduct a retrospective audit of logs to identify whether the endpoint was exploited before patching.

ComfyUI EUVD-2026-51401

| CVE-2026-56671 HIGH

Path Traversal (CWE-22)

2026-07-31 GitHub_M

Path Traversal Oracle Comfyui Comfy Org

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network traversal with low complexity (PR:N/AC:L/AV:N) yields file/host-path disclosure (C:H) but no write or availability impact (I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 31, 2026 - 06:15 EUVD

Source Code Evidence Fetched

Jul 31, 2026 - 05:47 vuln.today

Analysis Generated

Jul 31, 2026 - 05:47 vuln.today

CVE Published

Jul 31, 2026 - 04:21 cve.org

HIGH 7.5

DescriptionCVE.org

ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, get_model_preview in app/model_manager.py joins an unrestricted filename route capture to a selected model directory without a containment check, allowing an unauthenticated remote attacker to use traversal, encoded traversal, absolute paths, or an unbounded path_index to read image-decodable files and enumerate host paths. get_model_preview (app/model_manager.py) built the path with os.path.join(folder, filename) where filename is an unrestricted {filename:.*} route capture. Literal ../, percent-encoded %2e%2e%2f, and absolute paths all escaped the model directory; path_index was also unbounded. The target file is piped through Pillow and re-encoded as WEBP, so disclosure is limited to image-decodable files plus a file-existence/enumeration oracle (and internal-path leakage via path_index errors). This issue is fixed in version 0.28.0.

AnalysisAI

Unauthenticated information disclosure in ComfyUI (comfy-org/comfyui) before 0.28.0 lets remote attackers read arbitrary image-decodable files and enumerate the host filesystem via the get_model_preview endpoint, which joins an unrestricted {filename:.*} route capture to the model directory with no containment check (CWE-22). Attackers can use literal ../, percent-encoded %2e%2e%2f, absolute paths, or an unbounded path_index to escape the model folder; disclosure is bounded to files Pillow can decode plus a file-existence/path-enumeration oracle. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the issue is fixed in version 0.28.0.

Technical ContextAI

ComfyUI is a widely used node/graph-based GUI, API and backend for diffusion (Stable Diffusion-style) image generation models, exposing an aiohttp web server. The flaw lives in get_model_preview within app/model_manager.py, which constructed a filesystem path with os.path.join(folder, filename) where filename came from an aiohttp route capture defined as {filename:.*} - an unrestricted regex matching any characters including path separators and traversal sequences. Because os.path.join discards the base folder when the second argument is absolute, and because no normalization or prefix check was applied, both relative traversal and absolute paths escaped the intended model directory. The additional path_index parameter was parsed as an int with no bounds validation, producing internal-path leakage through error messages. This is a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) root cause; the vendor fix adds os.path.normpath plus a folder_paths.is_within_directory() containment check (using realpath + commonpath to also defeat symlink escape), rejects empty filenames and out-of-range path_index, and hardens sibling endpoints against dangerous content-type inline rendering.

RemediationAI

Vendor-released patch: upgrade to ComfyUI 0.28.0 or later (https://github.com/Comfy-Org/ComfyUI/releases/tag/v0.28.0), which adds path normalization and a realpath-based is_within_directory() containment check in app/model_manager.py plus validation of the filename and path_index parameters; see advisory GHSA-pj59-g5vv-74q4 and PR #14734. If immediate upgrade is not possible, do not expose the ComfyUI web server directly to untrusted networks - bind it to localhost or place it behind a reverse proxy/VPN and require authentication, since ComfyUI ships without authentication by default (trade-off: breaks remote multi-user access). As a targeted stopgap, block or filter requests to the model preview route (the /view / get_model_preview handler) at the proxy and reject requests whose filename contains traversal sequences, encoded traversal (%2e), or absolute paths (trade-off: may break legitimate preview thumbnails). Running the process under a least-privileged user on a container/host with minimal readable image files limits the value of the disclosure oracle.