CVE-2026-84702 in facefusion
Summary
by MITRE • 09/02/2026
facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in FaceFusion versions up to 3.6.1 represents a critical path traversal flaw within the application's file handling mechanisms, specifically located in the get_job_file_name function. This component is responsible for generating file paths based on job identifiers provided by users through an unauthenticated HTTP API endpoint. The core technical failure lies in the absence of proper input sanitization and normalization logic when processing these identifiers. Instead of validating that the supplied job identifier consists solely of safe alphanumeric characters or strictly adhering to a predefined naming convention, the application directly concatenates this user-supplied data with the base directory path designated for storing job files. This lack of validation allows an attacker to inject standard directory traversal sequences, such as dot-dot-slash (../), into the job identifier parameter.
When the application processes these malicious inputs, it fails to resolve or strip out the relative path components before constructing the final file system path. Consequently, instead of creating a new file within the intended jobs directory structure, the operating system interprets the traversal sequences and navigates up the directory tree. This behavior enables an attacker to write files at arbitrary locations on the server's file system where the application process has read and write permissions. The impact of this vulnerability is severe because it bypasses the expected sandboxing or isolation boundaries established by the application architecture. By controlling the destination path, a remote unauthenticated attacker can overwrite existing configuration files, inject malicious scripts into web-accessible directories, or place payload files in locations that facilitate further exploitation vectors such as server-side request forgery or arbitrary code execution if those paths are subsequently processed by other system components.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes flaws where software does not properly neutralize special elements within a file path that can cause the path to resolve to a location outside of the intended restricted directory. Furthermore, in terms of tactical mapping under the MITRE ATT&CK framework, this flaw facilitates Initial Access and potentially Persistence if the attacker writes web shells or configuration files that are automatically loaded by the application. The unauthenticated nature of the HTTP API endpoint exacerbates the risk significantly, as it removes any requirement for credential verification before the path traversal payload is executed, making exploitation straightforward and accessible to a wide range of threat actors with basic networking knowledge.
To mitigate this vulnerability, immediate remediation efforts should focus on implementing strict input validation within the get_job_file_name function. The application must enforce allowlisting strategies where job identifiers are restricted to alphanumeric characters, hyphens, and underscores, explicitly rejecting any path separators or traversal sequences. Additionally, developers should utilize canonicalization libraries provided by their programming language's standard library to resolve the full absolute path of the intended file location before performing any write operations. A critical security control is to verify that this resolved canonical path still resides within the expected base directory for jobs; if it does not, the operation must be aborted with an appropriate error response. Beyond code fixes, deploying a Web Application Firewall (WAF) can provide temporary protection by detecting and blocking requests containing common traversal patterns until the underlying application logic is patched. Regular security audits focusing on file system interactions are also recommended to ensure no similar flaws exist in other parts of the API surface area that handle user-supplied filenames or paths.