CVE-2026-56673
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
ComfyUI prior to version 0.28.0 is vulnerable in folder_paths.get_annotated_filepath and exists_annotated_filepath. They join workflow-controlled filenames to a base directory without containment check, allowing an unauthenticated attacker to craft a POST /prompt request using LoadImage or similar nodes to probe arbitrary host paths and exfiltrate image-format files through /view.
Risk Assessment
An attacker can read arbitrary image files on the server and obtain directory structure information, potentially leading to further attacks.
Recommendation
Update ComfyUI to version 0.28.0 or later.
Other vulnerabilities in ComfyUI
See all- CVE-2026-68771Critical
ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node. An unauthenticated attacker can upload a crafted pickle file via the POST /upload/image endpoint and trigger its deserialization via POST /prompt, leading to arbitrary Python code execution through torch.load.
- CVE-2026-56672High
ComfyUI prior to version 0.28.0 is vulnerable to stored cross-site scripting (XSS) in the GET /userdata/{file} endpoint. It serves user-controlled HTML and SVG files with extension-derived content types, allowing script execution in the ComfyUI origin and access to API tokens, settings, workflows, and authenticated-equivalent API calls.
- CVE-2026-56671High
ComfyUI prior to version 0.28.0 is vulnerable in the get_model_preview function in app/model_manager.py. It joins an unrestricted filename to a selected model directory without containment check, allowing an unauthenticated attacker to use traversal, absolute paths, or an unbounded path_index to read image-decodable files and enumerate host paths.
- CVE-2026-56670High
ComfyUI prior to version 0.28.0 is vulnerable to stored cross-site scripting (XSS) in the /view endpoint. It serves uploaded SVG files inline because image/svg+xml and related content types were not handled as dangerous, allowing script execution in the ComfyUI origin.
Original NVD description (English source)
ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node interface. Prior to 0.28.0, folder_paths.get_annotated_filepath and exists_annotated_filepath join workflow-controlled annotated filenames to a base directory without a containment check, allowing an unauthenticated crafted POST /prompt workflow using LoadImage or sibling nodes to probe arbitrary host paths and exfiltrate image-format files through /view. LoadImage defines a VALIDATE_INPUTS method, which causes the execution engine to skip COMBO (input-directory) validation. Affected nodes include LoadImage, LoadImageMask, LoadImageOutput, LoadAudio, LoadLatent, LoadVideo, and Load3D. This issue is fixed in version 0.28.0.