235 matches found
ComfyUI-Manager < 3.38 - Configuration Overwrite
ComfyUI-Manager 3.38 contains an insecure file storage vulnerability caused by storing files in an insufficiently protected location accessible via the web interface, letting remote attackers manipulate configuration and critical data, exploit requires web access. id: CVE-2025-67303 info: name:...
exploit_cve_2025_67303
exploitcve202567303 Create PoC for CVE-2025-67303 PoC original is https://www.doyensec.com/resources/DoyensecAdvisoryComfyUIManagerRCEviaCustomNodeInstall.pdf...
CVE-2026-68771_exploit
CVE-2026-68771 — ComfyUI Unauthenticated Pickle Deserialization RCE Unauthenticated remote code execution in ComfyUI via the LoadTrainingDataset node. LoadTrainingDataset.execute loads dataset shards from the server's output directory with torch.loadf and noweightsonly=True. On PyTorch /tmp/pwned...
CVE-2026-22777
CVE-2026-22777 — ComfyUI-Manager CRLFインジェクション - RCE CVE-2025-67303との連鎖 深刻度: クリティカル CVSS 9.8 影響を受けるバージョン: ComfyUI-Manager コード実行 仕組み ComfyUI-Managerは /api/manager/dbmode エンドポイントを公開しており、value クエリパラメータを受け取り、Pythonの configparser を使ってそれを直接 config.ini に書き込みます。 この脆弱性は ベアキャリッジリターンインジェクション \r / %0D です:...
ComfyUIrce
ComfyUIrce Git CVE-2025-67303 payload...
comfyui-CVE-2026-68771-PoC
CVE-2026-68771 — ComfyUI: Unauthenticated RCE via Insecure Deserialization For educational purposes only. Only use against systems you own or have explicit written authorization to test. About ComfyUI ComfyUI is an open-source node-based graphical interface for running AI image and video generati...
Exploit for CVE-2026-68771
CVE-2026-68771 — ComfyUI: Unauthenticated RCE via Insecure Des...
CVE-2026-92816
ComfyUI before 0.30.0 fails to sanitize foldername input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through...
CVE-2026-92816 ComfyUI before 0.30.0 Path Traversal via dataset save nodes
ComfyUI before 0.30.0 fails to sanitize foldername input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through...
EUVD-2026-81074
ComfyUI before 0.30.0 fails to sanitize foldername input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through...
CVE-2026-92816 ComfyUI before 0.30.0 Path Traversal via dataset save nodes
ComfyUI before 0.30.0 fails to sanitize foldername input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through...
CVE-2026-92816
ComfyUI versions before 0.30.0 contain a path traversal vulnerability in dataset save nodes (comfy_extras/nodes_dataset.py). The folder_name input is not properly sanitized, allowing an attacker to write files to arbitrary paths outside the intended output directory. By loading a crafted workflow...
CVE-2026-92816 ComfyUI before 0.30.0 Path Traversal via dataset save nodes
ComfyUI before 0.30.0 fails to sanitize foldername input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through...
CVE-2026-92816: Improper Limitation of a Pathname to a Restricted Directory
ComfyUI before 0.30.0 fails to sanitize foldername input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through...
OPENSUSE-SU-2026:11723-1 python313-comfyui-frontend-package-1.52.7-1.1 on GA media
These are all security issues fixed in the python313-comfyui-frontend-package-1.52.7-1.1 package on the GA media of openSUSE Tumbleweed...
Exploit for Unprotected Alternate Channel in Comfy Comfyui-Manager
No d...
ComfyUI stored XSS and path traversal vulnerabilities
RISK EVALUATION ComfyUI contains multiple vulnerabilities, with the most severe impact being that a remote, unauthenticated attacker could read image-decodable files and probe arbitrary host paths. 2. RECOMMENDED PRACTICES Fixed in 0.28.0. 3. DESCRIPTION ComfyUI is a modular diffusion model GUI,...
comfyui-0.33.3-1.1 on GA media (moderate)
comfyui-0.33.3-1.1 on GA media Announcement ID: openSUSE-SU-2026:11562-1 Rating: moderate Cross-References: CVE-2026-56670 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the comfyui-0.33.3-1....
SUSE CVE-2026-56670
ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, the /view endpoint served uploaded SVG files inline because image/svg+xml and related XML content types were absent from the dangerous-content-type handling, allowing stored cross-site scripti...
