CVE-2026-56671
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
ComfyUI prior to version 0.28.0 is vulnerable in the get_model_preview function in app/model_manager.py. It joins an unrestricted filename to a selected model directory without containment check, allowing an unauthenticated attacker to use traversal, absolute paths, or an unbounded path_index to read image-decodable files and enumerate host paths.
Risk Assessment
An attacker can read image files on the server and obtain directory structure information, potentially leading to further attacks.
Recommendation
Update ComfyUI to version 0.28.0 or later.
Other vulnerabilities in ComfyUI
See all- CVE-2026-68771Critical
ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node. An unauthenticated attacker can upload a crafted pickle file via the POST /upload/image endpoint and trigger its deserialization via POST /prompt, leading to arbitrary Python code execution through torch.load.
- CVE-2026-56673High
ComfyUI prior to version 0.28.0 is vulnerable in folder_paths.get_annotated_filepath and exists_annotated_filepath. They join workflow-controlled filenames to a base directory without containment check, allowing an unauthenticated attacker to craft a POST /prompt request using LoadImage or similar nodes to probe arbitrary host paths and exfiltrate image-format files through /view.
- CVE-2026-56672High
ComfyUI prior to version 0.28.0 is vulnerable to stored cross-site scripting (XSS) in the GET /userdata/{file} endpoint. It serves user-controlled HTML and SVG files with extension-derived content types, allowing script execution in the ComfyUI origin and access to API tokens, settings, workflows, and authenticated-equivalent API calls.
- CVE-2026-56670High
ComfyUI prior to version 0.28.0 is vulnerable to stored cross-site scripting (XSS) in the /view endpoint. It serves uploaded SVG files inline because image/svg+xml and related content types were not handled as dangerous, allowing script execution in the ComfyUI origin.
Original NVD description (English source)
ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, get_model_preview in app/model_manager.py joins an unrestricted filename route capture to a selected model directory without a containment check, allowing an unauthenticated remote attacker to use traversal, encoded traversal, absolute paths, or an unbounded path_index to read image-decodable files and enumerate host paths. get_model_preview (app/model_manager.py) built the path with os.path.join(folder, filename) where filename is an unrestricted {filename:.*} route capture. Literal ../, percent-encoded %2e%2e%2f, and absolute paths all escaped the model directory; path_index was also unbounded. The target file is piped through Pillow and re-encoded as WEBP, so disclosure is limited to image-decodable files plus a file-existence/enumeration oracle (and internal-path leakage via path_index errors). This issue is fixed in version 0.28.0.