Executive brief
FaceFusion is a face manipulation platform that provides an HTTP API for managing processing jobs. A path traversal vulnerability in the job identifier handling allows unauthenticated attackers to write files to arbitrary locations on the server, potentially leading to arbitrary code execution or system compromise.
Technical details
The vulnerability exists in the get_job_file_name function within facefusion's job manager, which fails to properly normalize and validate job identifier parameters. The function does not sanitize directory traversal sequences (e.g., "../") in the job identifier, allowing an attacker to construct paths that escape the intended jobs directory. By sending a crafted HTTP request to the unauthenticated API with a malicious job identifier containing traversal sequences, an attacker can write files to arbitrary locations on the filesystem. This attack requires no authentication and can be exploited remotely via the exposed HTTP API.
Affected products
- FaceFusion FaceFusion through 3.6.1
Timeline
- 2026-09-02: disclosed