4 matches found
CVE-2026-123790
ComfyUI-Easy-Use version 1.3.6 contains a path traversal vulnerability in the savepreview handler for POST /easyuse/save/name. The handler checks the source directory before appending a user-supplied filename and allows the request to select the customnodes directory as a copy destination. An...
CVE-2026-123790 Unauthenticated Path Traversal in ComfyUI-Easy-Use Allows Remote Code Execution
ComfyUI-Easy-Use version 1.3.6 contains a path traversal vulnerability in the savepreview handler for POST /easyuse/save/name. The handler checks the source directory before appending a user-supplied filename and allows the request to select the customnodes directory as a copy destination. An...
CVE-2026-123790
ComfyUI-Easy-Use version 1.3.6 is vulnerable to a path traversal vulnerability in the save_preview() handler for the POST /easyuse/save/{name} endpoint. The root cause is that the handler fails to properly restrict user-supplied filenames, allowing an unauthenticated attacker to select the custom...
EUVD-2026-124521
ComfyUI-Easy-Use version 1.3.6 contains a path traversal vulnerability in the savepreview handler for POST /easyuse/save/name. The handler checks the source directory before appending a user-supplied filename and allows the request to select the customnodes directory as a copy destination. An...