CVE-2023-46315

2023-10-2200:00:00

mitre

www.cve.org

zanllp sd-webui-infinite-image-browsing extension

security vulnerability

remote attackers

local files

gradio authentication

AI Score

7.8

Confidence

High

EPSS

0.001

Percentile

44.0%

JSON

The zanllp sd-webui-infinite-image-browsing (aka Infinite Image Browsing) extension before 977815a for stable-diffusion-webui (aka Stable Diffusion web UI), if Gradio authentication is enabled without secret key configuration, allows remote attackers to read any local file via /file?path= in the URL, as demonstrated by reading /proc/self/environ to discover credentials.