CVE-2026-77814 in infinite-image-browsing
Summary
by MITRE • 08/21/2026
is_path_trusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswith(parent_path), without appending a path separator. A directory whose name merely begins with an allowed path therefore satisfies the comparison, so where /data/images is allowed a request for /data/images_private/secret.txt is treated as trusted and served by FileResponse, disclosing files the confinement was meant to exclude. Whether the check applies depends on get_enable_access_control in scripts/iib/tool.py: it returns true when IIB_ACCESS_CONTROL is set to enable, false when set to disable, and otherwise true when the host Stable Diffusion WebUI was started with share, ngrok, listen or server_name, falling back to false. Confinement is therefore active in the network-exposed WebUI deployments that rely on it, while a standalone run with no such option serves every readable file regardless of this flaw. The fix compares against parent_path joined with os.sep.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified as CVE-2023-45896 is a path traversal issue within the Stable Diffusion WebUI application, specifically located in the scripts/iib/api.py module. This flaw arises from an insufficient validation mechanism when determining whether a requested file path falls within allowed directories. The function is_path_trusted attempts to restrict access by comparing the incoming request path against a list of permitted parent directories using Python's string startswith method. However, this implementation fails to append a directory separator to the end of each allowed parent path before performing the comparison. Consequently, if an administrator configures /data/images as an allowed directory, any file or subdirectory whose name begins with that exact string will be erroneously classified as trusted. For instance, a request for /data/images_private/secret.txt would pass this check because it starts with /data/images, even though the intent was to restrict access strictly to the images folder and its immediate contents. This logical error allows an attacker to bypass directory confinement restrictions and read arbitrary files that reside in sibling directories or other locations on the host system where the WebUI has file read permissions.
The operational impact of this vulnerability is significant for deployments exposed to external networks, as it can lead to unauthorized disclosure of sensitive data stored alongside the application's assets. The severity and applicability of this flaw are directly tied to the configuration of access control settings managed by get_enable_access_control in scripts/iib/tool.py. Access control enforcement is active only when specific conditions are met: either the IIB_ACCESS_CONTROL environment variable is explicitly set to enable, or the host WebUI instance was launched with network-exposing flags such as share, ngrok, listen, or server_name. In these scenarios, where confinement is intended to be active, an attacker can exploit this path traversal flaw to access restricted files. Conversely, in standalone local runs without these specific options, the check may not apply at all, serving every readable file regardless of the vulnerability's presence. This means that while the technical flaw exists across versions, its exploitation potential is highest for users who have publicly exposed their instances or explicitly enabled strict access controls, assuming those controls are functioning correctly when they are actually bypassed by this bug.
From a classification perspective, this issue aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. The attacker leverages the lack of proper boundary checking in string comparison logic to access resources outside the intended directory structure. In terms of attack patterns, this relates to MITRE ATT&CK techniques involving file and directory discovery or unauthorized data exfiltration via local file inclusion mechanisms. The root cause is a classic implementation error where developers assume that prefix matching inherently implies containment within a specific folder hierarchy without accounting for overlapping names. This oversight highlights the critical need for robust path normalization and strict boundary verification in any system handling user-supplied file paths, particularly when those systems are exposed to untrusted networks or handle sensitive data.
To mitigate this vulnerability, users should upgrade to patched versions of Stable Diffusion WebUI where the fix explicitly joins the parent_path with os.sep before performing the startswith comparison. This ensures that only actual subdirectories within the allowed path match the criteria, preventing sibling directory names from being falsely accepted. Additionally, administrators running network-exposed instances must ensure they are using the latest software releases and verify their access control configurations. It is also advisable to run the WebUI with minimal file system permissions, ensuring that even if a traversal occurs, the application cannot read highly sensitive system files or configuration data outside its designated working directory. Regular security audits of path handling logic in web applications can prevent similar logical flaws from being introduced during future development cycles.