CVE-2026-92816 in ComfyUI
Summary
by MITRE • 09/16/2026
ComfyUI before 0.30.0 fails to sanitize folder_name input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through modified startup files or package initializers.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in ComfyUI versions prior to 0.30.0 represents a critical path traversal and unrestricted file write flaw within the dataset save nodes of the application. This security defect stems from an insufficient sanitization mechanism applied to user-supplied input fields, specifically those designated for folder names during data export operations. In typical usage scenarios, users provide directory paths or folder identifiers that are intended to be relative to a predefined output root directory managed by the software. However, due to the lack of rigorous validation against path traversal sequences such as dot-dot-slash combinations and absolute path indicators, the application fails to enforce strict boundary constraints on these inputs. This oversight allows an attacker who can influence or supply workflow configurations to manipulate the underlying file system operations, effectively bypassing the intended sandboxing restrictions that isolate user-generated content within specific directories.
The operational impact of this vulnerability is severe because it grants attackers the ability to write arbitrary files to any location on the host operating system where ComfyUI has read and write permissions. By crafting a malicious workflow configuration, an adversary can specify file paths that escape the designated output directory and target sensitive areas of the filesystem. This capability transforms what might otherwise be considered a minor data integrity issue into a full remote code execution vector. The attacker is not limited to merely overwriting existing files or creating new ones in benign locations; they can strategically place malicious scripts, configuration overrides, or library initializers in directories that are automatically processed by Python interpreters or application startup routines upon subsequent executions of the software.
The exploitation path typically involves leveraging modified startup files or package initializers located within system-wide or user-specific environment paths such as site-packages directories or initialization hooks like _init_.py files. When ComfyUI restarts or loads specific modules, it may inadvertently execute code contained in these manipulated files. For instance, if an attacker writes a malicious Python script to a location that is included in the module search path and ensures it is imported during application startup, arbitrary commands can be executed with the privileges of the user running the ComfyUI process. This mechanism allows for persistent access, data exfiltration, or further lateral movement within the compromised environment, depending on the context in which the software operates.
From a classification perspective, this vulnerability aligns closely with CWE-22 Improper Limitation of a Pathname to a Restricted Directory and CWE-94 Improper Control of Generation of Code (Code Injection). The failure to validate input against path traversal patterns constitutes a classic directory traversal flaw, while the subsequent execution of attacker-controlled code through modified initialization files falls under code injection vulnerabilities. In terms of adversary tactics, this aligns with MITRE ATT&CK techniques related to Persistence via Startup Items and Command and Control channels that utilize legitimate system processes for malicious purposes. The ability to write arbitrary files is also consistent with CWE-732 Permission Issues leading to unauthorized access and modification of critical system resources.
Mitigation strategies must focus on both immediate remediation and long-term defensive coding practices. For users currently running affected versions, the primary recommendation is to upgrade immediately to ComfyUI version 0.30.0 or later, where this input sanitization flaw has been addressed by developers through stricter validation of folder name inputs. Until an update can be applied, administrators should restrict file system permissions for the user account executing ComfyUI, ensuring that it lacks write access to critical directories such as Python site-packages, system configuration folders, and other sensitive locations outside the designated output directory. Additionally, implementing application-level controls that canonicalize all provided paths before processing them can help prevent path traversal attacks by resolving symbolic links and relative references into absolute paths, allowing for accurate comparison against allowed base directories. Security monitoring should also be enhanced to detect unusual file creation events in system-critical directories, particularly those involving Python files or configuration changes during application runtime.