Path Traversal Vulnerability in ComfyUI by ComfyOrg
CVE-2026-56671
What is CVE-2026-56671?
In versions prior to 0.28.0 of ComfyUI, a path traversal vulnerability exists within the get_model_preview function found in app/model_manager.py. The function joins an unrestricted filename route capture and a selected model directory without adequate containment checks. This allows unauthenticated remote attackers to exploit traversal techniques such as encoded traversal or absolute paths to access sensitive files. The vulnerability enables attackers to read image-decodable files, resulting in potential file enumeration and internal path leakage through path_index errors. The limited disclosure is primarily oriented around images, as the targeted files are processed via Pillow and re-encoded as WEBP. This issue has been addressed in version 0.28.0.
Affected Version(s)
ComfyUI < 0.28.0