Executive brief
ComfyUI, a popular interface for AI image generation models, contains a security flaw in how it handles model preview images. An unauthorized attacker can exploit this to bypass folder restrictions and view sensitive image files stored anywhere on the host server. This could lead to the exposure of private user assets or internal system information, particularly in shared or cloud-based environments.
Technical details
A path traversal vulnerability exists in the `get_model_preview` function within `app/model_manager.py`. The application uses `os.path.join(folder, filename)` where `filename` is an unrestricted route capture (`{filename:.*}`) without a containment check. An unauthenticated remote attacker can use literal `../` sequences, percent-encoded traversal (`%2e%2e%2f`), or absolute paths to escape the intended model directory. While the disclosure is limited to files that can be decoded by the Pillow library (re-encoded as WEBP), the flaw also functions as a file-existence oracle and can leak internal paths via `path_index` errors. The issue is resolved in version 0.28.0 by implementing `realpath` and `os.path.commonpath` validation.
Affected products
- Comfy-Org ComfyUI < 0.28.0
Timeline
- 2026-07-03: patched: Fix merged into master branch
- 2026-07-15: advisory: GitHub Security Advisory published
- 2026-07-31: disclosed: CVE published to NVD