ComfyUI EUVD-2026-51401

Exploitation requires network access to ComfyUI's built-in web server and a reachable model preview request handled by get_model_preview in app/model_manager.py on any version before 0.28.0 - no authentication, credentials, or user interaction are needed (AV:N/AC:L/PR:N/UI:N against default configurations, since ComfyUI ships without authentication). The attacker must supply the traversal via the {filename:.*} route capture (literal ../, encoded %2e%2e%2f, or an absolute path) or an out-of-range path_index. Key LIMITING factors: full content disclosure is restricted to files Pillow can decode and re-encode as WEBP (images); all other files yield only a file-existence/enumeration oracle plus internal-path leakage rather than raw content, so this is not a general arbitrary-text-file read. Exploitation is also gated by the server being network-exposed, which is not the default binding for many local installs.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) indicates a network-reachable, low-complexity, unauthenticated read primitive with no integrity or availability impact - consistent with the description of an unauthenticated remote traversal oracle. Real-world impact is meaningfully constrained by the design: the target file is piped through Pillow and re-encoded as WEBP, so full content disclosure is limited to image-decodable files, while non-image files yield only a file-existence/enumeration signal and internal path leakage - arguably closer to C:L for arbitrary secrets, though C:H is defensible given unrestricted host-path enumeration and disclosure of any image on disk. No EPSS score, KEV entry, POC, or SSVC decision data was provided in the input, so probability-of-exploitation and automatability cannot be quantified from these sources; the absence of KEV and POC signals suggests this is not yet weaponized. Net: a genuine unauthenticated exposure worth prompt patching, but the image-only content constraint makes it a reconnaissance/limited-disclosure issue rather than a direct arbitrary-file-read of credentials.

A remote attacker who can reach the ComfyUI HTTP interface sends a crafted request to the model preview endpoint with a filename such as ../../../../ or an absolute path, using literal or percent-encoded traversal, to enumerate host directories and read any image-decodable file outside the model folder. By observing successful WEBP responses versus errors (including path_index error messages), the attacker maps the filesystem and confirms file existence. No authentication or user interaction is required (PR:N/UI:N); no public POC is currently identified.