Path Traversal Vulnerability in ComfyUI-Easy-Use by Yolain

CVE-2026-123790

What is CVE-2026-123790?

The ComfyUI-Easy-Use application, specifically version 1.3.6, contains a vulnerability in the save_preview() functionality which allows for path traversal. This issue arises from improper validation of user-supplied filenames, enabling attackers to select the custom_nodes directory as a destination for their uploads. An unauthenticated attacker can exploit this flaw to overwrite critical Python entry points of installed custom nodes with malicious content. Upon the restart of the ComfyUI application, the compromised node runs with the application's privileges, potentially leading to significant security breaches.

References