CVE-2026-77815
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
to_abs_path in scripts/iib/tool.py normalizes the path with os.path.normpath, which does not resolve symbolic links. A symlink placed inside a scanned directory can point outside that directory, and FileResponse follows the link, disclosing files such as /etc/passwd.
Risk Assessment
An attacker can access sensitive system files, potentially leading to data leakage or privilege escalation.
Recommendation
Upgrade Stable Diffusion WebUI to a version that includes a fix using os.path.realpath to resolve paths.
Other vulnerabilities in Stable Diffusion WebUI
See all- CVE-2026-82288High
Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradio_auth and api_auth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured usernames and passwords, then use them to authenticate to the interface and access the application.
- CVE-2026-77814High
is_path_trusted in scripts/iib/api.py compares the requested path against allowed parent directories with path.startswith(parent_path), without appending a path separator. A directory whose name merely begins with an allowed path satisfies the comparison, allowing access to files outside the allowed directory.
Original NVD description (English source)
to_abs_path in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but does not resolve symbolic links. A symlink placed inside a scanned directory therefore satisfies the containment comparison performed by is_path_trusted in scripts/iib/api.py while pointing outside that directory, and FileResponse follows the link when serving the response, so a link created in an image directory and targeting a file such as /etc/passwd discloses that file. Whether the check applies depends on get_enable_access_control in scripts/iib/tool.py: it returns true when IIB_ACCESS_CONTROL is set to enable, false when set to disable, and otherwise true when the host Stable Diffusion WebUI was started with share, ngrok, listen or server_name, falling back to false. Confinement is therefore active in the network-exposed WebUI deployments that rely on it, while a standalone run with no such option serves every readable file regardless of this flaw. The fix resolves the path with os.path.realpath.