235 matches found
ComfyUI-Manager < 3.38 - Configuration Overwrite
ComfyUI-Manager 3.38 contains an insecure file storage vulnerability caused by storing files in an insufficiently protected location accessible via the web interface, letting remote attackers manipulate configuration and critical data, exploit requires web access. id: CVE-2025-67303 info: name:...
CVE-2026-68771_exploit
CVE-2026-68771 — Неаутентифицированное удалённое выполнение кода через десериализацию pickle в ComfyUI Неаутентифицированное удалённое выполнение кода в ComfyUI через узел LoadTrainingDataset. LoadTrainingDataset.execute загружает шарды данных из выходного каталога сервера с помощью torch.loadf и...
CVE-2026-22777
CVE-2026-22777 — CRLF-инъекция в ComfyUI-Manager - RCE в связке с CVE-2025-67303 Критичность: Критическая CVSS 9.8 Затронуто: ComfyUI-Manager Выполнение кода Как это работает ComfyUI-Manager предоставляет эндпоинт /api/manager/dbmode, который принимает query-параметр value и записывает его напрям...
ComfyUIrce
ComfyUIrce payload Git CVE-2025-67303...
comfyui-CVE-2026-68771-PoC
CVE-2026-68771 — ComfyUI: неаутентифицированное RCE через небезопасную десериализацию Только в образовательных целях. Используйте только против систем, которыми вы владеете или на тестирование которых у вас есть явное письменное разрешение. О ComfyUI ComfyUI — это открытый графический интерфейс н...
exploit_cve_2025_67303
exploitcve202567303 Créer un PoC pour CVE-2025-67303 Le PoC original est https://www.doyensec.com/resources/DoyensecAdvisoryComfyUIManagerRCEviaCustomNodeInstall.pdf...
Exploit for CVE-2026-68771
CVE-2026-68771 — ComfyUI: Unauthenticated RCE via Insecure Des...
CVE-2026-92816
ComfyUI before 0.30.0 fails to sanitize foldername input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through...
CVE-2026-92816 ComfyUI before 0.30.0 Path Traversal via dataset save nodes
ComfyUI before 0.30.0 fails to sanitize foldername input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through...
CVE-2026-92816 ComfyUI before 0.30.0 Path Traversal via dataset save nodes
ComfyUI before 0.30.0 fails to sanitize foldername input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through...
EUVD-2026-81074
ComfyUI before 0.30.0 fails to sanitize foldername input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through...
CVE-2026-92816 ComfyUI before 0.30.0 Path Traversal via dataset save nodes
ComfyUI before 0.30.0 fails to sanitize foldername input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through...
CVE-2026-92816
ComfyUI versions before 0.30.0 contain a path traversal vulnerability in dataset save nodes (comfy_extras/nodes_dataset.py). The folder_name input is not properly sanitized, allowing an attacker to write files to arbitrary paths outside the intended output directory. By loading a crafted workflow...
CVE-2026-92816: Improper Limitation of a Pathname to a Restricted Directory
ComfyUI before 0.30.0 fails to sanitize foldername input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through...
OPENSUSE-SU-2026:11723-1 python313-comfyui-frontend-package-1.52.7-1.1 on GA media
These are all security issues fixed in the python313-comfyui-frontend-package-1.52.7-1.1 package on the GA media of openSUSE Tumbleweed...
Exploit for Unprotected Alternate Channel in Comfy Comfyui-Manager
No d...
ComfyUI stored XSS and path traversal vulnerabilities
RISK EVALUATION ComfyUI contains multiple vulnerabilities, with the most severe impact being that a remote, unauthenticated attacker could read image-decodable files and probe arbitrary host paths. 2. RECOMMENDED PRACTICES Fixed in 0.28.0. 3. DESCRIPTION ComfyUI is a modular diffusion model GUI,...
comfyui-0.33.3-1.1 on GA media (moderate)
comfyui-0.33.3-1.1 on GA media Announcement ID: openSUSE-SU-2026:11562-1 Rating: moderate Cross-References: CVE-2026-56670 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the comfyui-0.33.3-1....
SUSE CVE-2026-56670
ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, the /view endpoint served uploaded SVG files inline because image/svg+xml and related XML content types were absent from the dangerous-content-type handling, allowing stored cross-site scripti...
