Executive brief
ComfyUI is a popular interface and backend used for generating images and media using AI models. A security flaw allows unauthenticated remote users to bypass directory restrictions and access files on the host server that they should not be able to see. This could lead to the theft of private images, audio, or other media files, and allows attackers to map out the server's file structure.
Technical details
A path traversal vulnerability exists in ComfyUI's 'folder_paths.get_annotated_filepath' and 'exists_annotated_filepath' functions. These functions join user-controlled filenames to a base directory without performing a containment check (such as verifying the commonpath), allowing the use of '../' sequences to escape the intended directory. Furthermore, the 'LoadImage' node defines a 'VALIDATE_INPUTS' method that inadvertently causes the execution engine to skip standard input directory validation. An unauthenticated attacker can exploit this by sending a crafted POST request to the '/prompt' endpoint to probe for the existence of arbitrary files or exfiltrate image-format files via the '/view' endpoint. Affected nodes include LoadImage, LoadImageMask, LoadImageOutput, LoadAudio, LoadLatent, LoadVideo, and Load3D. The issue is resolved in version 0.28.0 by hardening path resolution logic.
Affected products
- Comfy-Org ComfyUI < 0.28.0
Timeline
- 2026-07-03: patched: Fixes merged into master branch
- 2026-07-15: advisory: GitHub Security Advisory published
- 2026-07-31: disclosed: CVE published to NVD