CVE-2026-77815 in infinite-image-browsing
Summary
by MITRE • 08/21/2026
to_abs_path in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but does not resolve symbolic links. A symlink placed inside a scanned directory therefore satisfies the containment comparison performed by is_path_trusted in scripts/iib/api.py while pointing outside that directory, and FileResponse follows the link when serving the response, so a link created in an image directory and targeting a file such as /etc/passwd discloses that file. Whether the check applies depends on get_enable_access_control in scripts/iib/tool.py: it returns true when IIB_ACCESS_CONTROL is set to enable, false when set to disable, and otherwise true when the host Stable Diffusion WebUI was started with share, ngrok, listen or server_name, falling back to false. Confinement is therefore active in the network-exposed WebUI deployments that rely on it, while a standalone run with no such option serves every readable file regardless of this flaw. The fix resolves the path with os.path.realpath.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability described involves a critical path traversal and information disclosure flaw within the Inference Interface Builder (IIB) tooling for Stable Diffusion WebUI, specifically located in the scripts/iib/tool.py module. The core technical deficiency lies in how the to_abs_path function normalizes file paths using os.path.normpath. While this standard library function effectively collapses dot segments such as .. and . to create a canonical path string, it does not resolve symbolic links or follow them to their actual physical location on the filesystem. This limitation creates a significant security gap when combined with access control mechanisms that rely on directory containment checks. An attacker can exploit this by creating a symbolic link within a scanned image directory that points to sensitive files located outside of that directory, such as /etc/passwd or other configuration files accessible by the user running the application.
The operational impact is driven by the interaction between path normalization and trust verification logic in scripts/iib/api.py. The system employs an is_path_trusted function to determine if a requested file should be served. This check verifies whether the normalized absolute path of the request remains within the boundaries of trusted directories. Because os.path.normpath does not resolve symlinks, a symlinked file inside a trusted directory appears to satisfy the containment comparison even though its actual target resides in an untrusted or sensitive area outside that boundary. Consequently, when FileResponse attempts to serve the requested content, it follows the symbolic link and retrieves data from the external location, resulting in unauthorized information disclosure. This flaw allows local attackers with write access to image directories to read arbitrary files readable by the application process, bypassing intended isolation boundaries.
The severity and applicability of this vulnerability are heavily dependent on the configuration state of the IIB_ACCESS_CONTROL environment variable as evaluated by get_enable_access_control in scripts/iib/tool.py. The security controls are active only when access control is explicitly enabled or when specific network exposure flags such as share, ngrok, listen, or server_name are present during startup. In these scenarios, where remote users might interact with the interface and rely on path validation for safety, the symlink-based bypass allows external attackers to exfiltrate sensitive host data if they can inject symlinks into accessible directories. Conversely, in standalone local deployments without network exposure flags, access control defaults to false or is disabled by configuration, meaning every readable file is served regardless of this flaw. However, given that many production and shared instances utilize the aforementioned flags for accessibility, a substantial portion of deployments remain vulnerable to remote path traversal via symbolic links when access control features are engaged.
From an industry standards perspective, this vulnerability maps directly to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as Path Traversal. The specific mechanism involving symbolic link resolution failures aligns with CWE-59: Improper Link Resolution Before File Access (Link Following). Furthermore, the exploitation technique corresponds to ATT&CK T1083: File and Directory Discovery, where an adversary uses system-level features like symlinks to enumerate and access restricted files. The failure to resolve real paths before performing security checks represents a classic implementation error in path validation logic, often referred to as TOCTOU (Time of Check to Time of Use) variants or simply insufficient canonicalization.
To mitigate this vulnerability, the primary remediation is to replace os.path.normpath with os.path.realpath when resolving file paths for access control decisions. The realpath function not only normalizes dot segments but also resolves all symbolic links to their actual physical locations on the filesystem. This ensures that containment checks accurately reflect the true location of the resource being accessed, preventing symlinks from bypassing directory boundaries. Additionally, developers should implement strict allowlisting of permitted directories and consider disabling symlink following at the application level if possible, or ensuring that file serving mechanisms do not automatically resolve links without explicit validation. Regular security audits focusing on path manipulation in web frameworks are essential to prevent similar issues where normalization functions fall short of providing true physical path verification.