ComfyUI EUVD-2026-51403

Exploitation requires network reachability to the ComfyUI HTTP API and the ability to submit a workflow via POST /prompt using one of the loader nodes (LoadImage, LoadImageMask, LoadImageOutput, LoadAudio, LoadLatent, LoadVideo, Load3D) with an attacker-controlled annotated filename; no authentication is needed (PR:N) and no user interaction is required (UI:N) against default configurations prior to 0.28.0. The specific enabling condition is that LoadImage's VALIDATE_INPUTS method makes the execution engine skip COMBO input-directory validation, and folder_paths performs no containment check. Limiting factors: successful exfiltration through /view is constrained to files the server can serve as image formats, so non-image file contents are not directly readable; deployments that require authentication in front of the API, restrict /prompt and /view, or are bound to localhost/isolated networks are not remotely exploitable; and already patched instances (>=0.28.0) are not affected.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N describes a low-complexity, network-reachable, unauthenticated attack with high confidentiality impact and no integrity or availability impact - internally consistent with the description. Real risk is elevated because ComfyUI is frequently run without authentication and increasingly exposed to networks or the internet, and the exploit is a simple crafted POST /prompt requiring no user interaction. The offset is that impact is bounded: exfiltration through /view is limited to files the server can render as image formats, so it is a targeted file-disclosure / path-probing primitive rather than full arbitrary file read of any content, and it grants no code execution or write access. No EPSS score, KEV listing, SSVC decision, or POC was provided; absence of KEV/EPSS data means widespread automated exploitation cannot be confirmed. Overall this is a genuine, easily-triggered information-disclosure issue worth prompt patching, but the confidentiality-only, image-format-limited nature keeps it below RCE-class urgency.

An attacker who can reach a ComfyUI instance's HTTP API sends a crafted POST /prompt containing a workflow whose LoadImage (or LoadImageOutput/Load3D) node supplies an annotated filename with ../ traversal sequences pointing outside the input directory. Because VALIDATE_INPUTS causes the engine to skip input-directory validation and no containment check is applied, the server resolves and loads the out-of-scope path, and the attacker then retrieves the rendered image bytes via GET /view to exfiltrate or confirm the existence of arbitrary host files. Given AV:N/AC:L/PR:N/UI:N, this requires only network reachability and no credentials, though no public PoC was provided in the input.