Junglewise Threat Intelligence

CVE-2025-67303: Comfy-Org ComfyUI-Manager unprotected alternate channel in configuration directory

CVE-2025-67303 · Severity: high · CVSS 7.5 · Published 2026-06-22

Executive brief

ComfyUI-Manager, a popular extension for managing custom nodes and models in the ComfyUI interface, contained a security flaw where its configuration files were stored in a location accessible via the web. This allowed remote attackers to bypass security controls, modify system settings, and potentially install malicious software components. The vulnerability primarily affects systems configured to be accessible over a network rather than just on a local computer.

Technical details

ComfyUI-Manager (prior to v3.38) stored configuration and critical data in the 'user/default/ComfyUI-Manager/' directory, which was exposed via ComfyUI's web APIs without sufficient access control (CWE-420). A remote, unauthenticated attacker could exploit this to modify security levels, tamper with custom node sources, or corrupt system snapshots. The fix involves migrating data to a protected directory ('user/__manager/') that utilizes the ComfyUI System User Protection API (introduced in ComfyUI v0.3.76) to block external web API access. Exploitation is most feasible on systems running with the '--listen 0.0.0.0' flag.

Affected products

  • Comfy-Org ComfyUI-Manager < 3.38
  • Comfy-Org ComfyUI < 0.3.76

Timeline

  • 2026-01-05: disclosed: Initial CVE assignment and NVD entry
  • 2026-01-11: patched: Version 3.38 released with security migration
  • 2026-06-22: advisory: GitHub Advisory published

References

Related threats