Claude Comfyui Mcp
Monthly
Path traversal in claude-comfyui-mcp 1.0.0 enables local low-privileged users to escape the intended upload directory by supplying crafted `../` sequences as the `image_path` argument to the `comfy_upload_image` tool. The unsanitized input is passed directly to Node.js `copyFileSync` in `src/tools/utils.ts`, allowing reads or writes to arbitrary files accessible by the server process. A proof-of-concept exists (CVSS 4.0 E:P), and the project maintainer has not responded to responsible disclosure, leaving no vendor patch available at time of analysis.
Path traversal in claude-comfyui-mcp 1.0.0 enables local low-privileged users to escape the intended upload directory by supplying crafted `../` sequences as the `image_path` argument to the `comfy_upload_image` tool. The unsanitized input is passed directly to Node.js `copyFileSync` in `src/tools/utils.ts`, allowing reads or writes to arbitrary files accessible by the server process. A proof-of-concept exists (CVSS 4.0 E:P), and the project maintainer has not responded to responsible disclosure, leaving no vendor patch available at time of analysis.