Executive brief
ComfyUI-Manager, a popular extension for managing ComfyUI nodes and models, contained a security flaw where critical configuration files were stored in a location accessible via the web. An attacker could remotely modify these files, potentially altering the application's behavior or compromising its data. This could lead to unauthorized changes in how the software operates or the loss of important user settings.
Technical details
ComfyUI-Manager prior to version 3.38 is vulnerable to an Unprotected Alternate Channel (CWE-420). The application stored configuration and critical data files in a directory that was inadvertently exposed through the web server's public path. A remote, unauthenticated attacker could exploit this by sending network requests to modify these files, leading to integrity loss of the application's configuration. The issue was addressed in version 3.38 by migrating user data to a protected location and implementing a System User Protection API.
Affected products
- Comfy-Org ComfyUI-Manager < 3.38
Timeline
- 2025-12-02: patched: Security migration and protection API merged in PR 2338
- 2026-01-05: disclosed: Initial advisory publication
- 2026-06-22: other: Advisory withdrawn as a duplicate of GHSA-95pq-hr8p-f5g7