Executive brief
Infinite Image Browsing (IIB) is an image management application that can be deployed as a Stable Diffusion WebUI extension or standalone service. A flaw in path validation allows an attacker to create a symbolic link inside the scanned image directory that points to sensitive system files (such as /etc/passwd), bypassing access controls and disclosing the contents of those files when the link is accessed through the web interface.
Technical details
The vulnerability is a path traversal/symlink resolution flaw in the to_abs_path function in scripts/iib/tool.py. The function uses os.path.normpath() to normalize paths, which collapses dot segments (..) but does not resolve symbolic links. The is_path_trusted check in scripts/iib/api.py validates that the normalized path stays within the scanned directory, but this check is bypassed when a symlink inside the directory targets a file outside it (the symlink itself appears trusted, but FileResponse follows the link). Access control is enabled when IIB_ACCESS_CONTROL is set to "enable" or when the host Stable Diffusion WebUI is started with share, ngrok, listen, or server_name flags. The fix uses os.path.realpath() instead of os.path.normpath() to properly resolve symbolic links before validation.
Affected products
- zanllp Infinite Image Browsing
Timeline
- 2026-08-21: disclosed