ComfyUI stored XSS and path traversal vulnerabilities
view advisory published 2026-08-26
ComfyUI contains multiple vulnerabilities, with the most severe impact being that a remote, unauthenticated attacker could read image-decodable files and probe arbitrary host paths.
01
describes (4)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-56673US | — | — | ||
ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node interface. Prior to 0.28.0, folder_paths.get_annotated_filepath and exists_annotated_filepath join… | ||||
| CVE-2026-56672US | — | — | ||
ComfyUI is a node-based diffusion model GUI, API, and backend. Prior to 0.28.0, GET /userdata/{file} served user-controlled HTML and SVG files with extension-derived content types,… | ||||
| CVE-2026-56671US | — | — | ||
ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, get_model_preview in app/model_manager.py joins an unrestricted filename ro… | ||||
| CVE-2026-56670US | — | — | ||
ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, the /view endpoint served uploaded SVG files inline because image/svg+xml a… | ||||
02
references
External citations — patches, advisories, analysis.
03
remediations (4)
- Fixedcomfyui
Fixed in 0.28.0.
https://github.com/Comfy-Org/ComfyUI/releases/tag/v0.28.0 - Fixedcomfyui
Fixed in 0.28.0.
https://github.com/Comfy-Org/ComfyUI/releases/tag/v0.28.0 - Fixedcomfyui
Fixed in 0.28.0.
https://github.com/Comfy-Org/ComfyUI/releases/tag/v0.28.0 - Fixedcomfyui
Fixed in 0.28.0.
https://github.com/Comfy-Org/ComfyUI/releases/tag/v0.28.0
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan