CVE-2026-56673 in ComfyUI
Summary
by MITRE • 07/31/2026
ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node interface. Prior to 0.28.0, folder_paths.get_annotated_filepath and exists_annotated_filepath join workflow-controlled annotated filenames to a base directory without a containment check, allowing an unauthenticated crafted POST /prompt workflow using LoadImage or sibling nodes to probe arbitrary host paths and exfiltrate image-format files through /view. LoadImage defines a VALIDATE_INPUTS method, which causes the execution engine to skip COMBO (input-directory) validation. Affected nodes include LoadImage, LoadImageMask, LoadImageOutput, LoadAudio, LoadLatent, LoadVideo, and Load3D. This issue is fixed in version 0.28.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/31/2026
ComfyUI represents a sophisticated modular diffusion model interface that operates through graph-and-node architecture for processing AI workflows. The vulnerability stems from insufficient input validation mechanisms within the folder path handling functions, specifically get_annotated_filepath and exists_annotated_filepath, which fail to implement proper containment checks when processing user-controlled annotated filenames. This design flaw creates a directory traversal vulnerability where malicious actors can manipulate workflow parameters to access arbitrary file paths on the host system.
The technical exploitation occurs through crafted POST requests to the /prompt endpoint where nodes such as LoadImage and its siblings execute without proper validation of input directories. The VALIDATE_INPUTS method implemented in LoadImage inadvertently bypasses COMBO input directory validation, creating a pathway for attackers to probe system directories and exfiltrate image-format files via the /view endpoint. This vulnerability affects multiple file loading nodes including LoadImageMask, LoadImageOutput, LoadAudio, LoadLatent, LoadVideo, and Load3D, all of which share the same underlying path handling mechanism.
The operational impact of this vulnerability is significant as it allows unauthenticated remote attackers to perform directory traversal attacks against ComfyUI instances. Attackers can systematically probe host file systems to discover sensitive files, potentially accessing configuration data, model weights, or other valuable assets stored within the system. The ability to exfiltrate image-format files through the /view endpoint creates a data leakage vector that could compromise intellectual property or expose sensitive information contained in processed media files.
This vulnerability maps directly to CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and aligns with ATT&CK technique T1059.001 (Command and Scripting Interpreter: PowerShell) through potential post-exploitation activities. The flaw demonstrates poor input sanitization practices in web applications handling file operations, where user-controllable data should never be directly concatenated with system paths without proper validation. Organizations running ComfyUI versions prior to 0.28.0 should immediately implement mitigations including network segmentation, input validation enforcement, and application firewalls to prevent unauthorized path traversal attempts. The fix in version 0.28.0 addresses this by implementing proper containment checks that validate all file paths against allowed directories, preventing arbitrary file access while maintaining the intended functionality of the diffusion model interface.