CVE-2026-123790

ComfyUI-Easy-Use version 1.3.6 contains a path traversal vulnerability in the savepreview handler for POST /easyuse/save/name. The handler checks the source directory before appending a user-supplied filename and allows the request to select the customnodes directory as a copy destination. An...