CVE-2026-56672

🗓️ 31 Jul 2026 04:27:18Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 62 Views🌐 WEB

Stored cross site scripting in ComfyUI via /userdata/{file} due to missing content-type sanitization; fixed in 0.28.0.

Reporter	Title	Published	Views	Family All 8
attackerkb	CVE-2026-56672	31 Jul 202604:27	–	attackerkb
Circl	CVE-2026-56672	2 Aug 202619:00	–	circl
Cvelist	CVE-2026-56672 ComfyUI: Stored XSS via /userdata/{file} due to Missing Content-Type Sanitization	31 Jul 202604:27	–	cvelist
EUVD	EUVD-2026-51402	31 Jul 202604:27	–	euvd
NVD	CVE-2026-56672	31 Jul 202606:16	–	nvd
Positive Technologies	PT-2026-66679	31 Jul 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-56672: Improper Neutralization of Input During Web Page Generation	31 Jul 202600:00	–	rapid7
Vulnrichment	CVE-2026-56672 ComfyUI: Stored XSS via /userdata/{file} due to Missing Content-Type Sanitization	31 Jul 202604:27	–	vulnrichment

Vulners

Node

comfy comfyuiRange<0.28.0

[
  {
    "vendor": "Comfy-Org",
    "product": "ComfyUI",
    "versions": [
      {
        "version": "< 0.28.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/Comfy-Org/ComfyUI/releases/tag/v0.28.0
github	www.github.com/Comfy-Org/ComfyUI/commit/96e0e3585b41e1417442eaa14ec57f7b4ffcb5e0
github	www.github.com/Comfy-Org/ComfyUI/security/advisories/GHSA-53g8-45wq-pcv8

Parameter	Position	Path	Description	CWE
file	path	/userdata/{file}	Stored XSS via user-controlled HTML/SVG served from /userdata/{file} due to content-type handling, enabling same-origin script execution and access to tokens when a victim visits the file URL.	CWE-79
request_body	request body	/userdata	Allows storing arbitrary request bodies in the userdata directory, enabling upload of HTML/SVG that can later be served to victims and trigger stored XSS.	CWE-79

08 Sep 2026 20:41Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.18.2

EPSS0.00397

SSVC

CWE-79