CVE-2024-10481

🗓️ 20 Mar 2025 10:09:02Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov👁 50 Views🌐 WEB

CSRF vulnerability in ComfyUI allows unauthorized API actions via malicious websites on authenticated users.

Reporter	Title	Published	Views	Family All 7
CNNVD	ComfyUI 跨站请求伪造漏洞	20 Mar 202500:00	–	cnnvd
Cvelist	CVE-2024-10481 Cross-Site Request Forgery (CSRF) in comfyanonymous/comfyui	20 Mar 202510:09	–	cvelist
EUVD	EUVD-2025-7106	3 Oct 202520:07	–	euvd
NVD	CVE-2024-10481	20 Mar 202510:15	–	nvd
Positive Technologies	PT-2025-12042 · Comfyanonymous · Comfyui	20 Mar 202500:00	–	ptsecurity
RedhatCVE	CVE-2024-10481	22 Mar 202513:06	–	redhatcve
Vulnrichment	CVE-2024-10481 Cross-Site Request Forgery (CSRF) in comfyanonymous/comfyui	20 Mar 202510:09	–	vulnrichment

NVD

Node

comfy comfyuiRange≤0.2.2

[
  {
    "vendor": "comfyanonymous",
    "product": "comfyanonymous/comfyui",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "versionType": "custom",
        "lessThanOrEqual": "latest"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/f4d5bfb5-6ff1-4356-b81f-f8c01d2e6ded

Parameter	Position	Path	Description	CWE
image	request body	/upload/image	CSRF vulnerability allows authenticated users to trigger file uploads via the API without CSRF protections.	CWE-352
prompt	request body	/prompt	CSRF vulnerability allows authenticated users to trigger prompt-related actions via the API without CSRF protections.	CWE-352
history_id	request body	/history	CSRF vulnerability allows authenticated users to perform actions affecting history via the API without CSRF protections.	CWE-352

17 Jun 2026 06:55Current

6.9Medium risk

Vulners AI Score6.9

CVSS 36.5

EPSS0.00208

SSVC

CWE-352