Vulnerabilities

TI-2026-62555 CVE-2026-92816 · GHSA-xhvx-vf8p-rh4x

ComfyUI before 0.30.0 Path Traversal via dataset save nodes

HIGH 72

ComfyUI before 0.30.0 fails to sanitize folder_name input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory.

CVSS 4.0HIGH 8.5 Local No auth User interaction EPSS 0.00203 Published 2026-09-16 Fixed in 0.30.0 CWE-22

TI-2026-48352 CVE-2026-68771 · GHSA-6p72-9j26-4rmx

ComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle Deserialization

MEDIUM 50

ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and trigge…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.01148 Published 2026-07-31 No fix listed CWE-502

TI-2026-40857 CVE-2026-56673

ComfyUI: Path traversal in LoadImage via the /prompt API allows arbitrary file existence probing and image exfiltration

MEDIUM 40

ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00632 Published 2026-07-31 Fixed in 0.28.0 CWE-22

TI-2026-40856 CVE-2026-56672

ComfyUI: Stored XSS via /userdata/{file} due to Missing Content-Type Sanitization

LOW 36

ComfyUI is a node-based diffusion model GUI, API, and backend.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00397 Published 2026-07-31 Fixed in 0.28.0 CWE-79

TI-2026-40855 CVE-2026-56671

ComfyUI: Path traversal in /experiment/models/preview allows arbitrary image file read

MEDIUM 41

ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00971 Published 2026-07-31 Fixed in 0.28.0 CWE-22

TI-2026-40854 CVE-2026-56670

ComfyUI: Stored XSS via SVG file upload on the /view endpoint