ComfyUI-Manager up to 3.37 Web Interface unprotected alternate channel

Summaryinfo

A vulnerability marked as critical has been reported in ComfyUI-Manager up to 3.37. Impacted is an unknown function of the component Web Interface. This manipulation causes an unknown weakness. This vulnerability appears as CVE-2025-67303. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in ComfyUI-Manager up to 3.37. Affected by this vulnerability is an unknown code of the component Web Interface. The CWE definition for the vulnerability is CWE-420. The product protects a primary channel, but it does not use the same level of protection for an alternate channel. The impact remains unknown. The summary by CVE is:

An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data. This was due to the application storing its files in an insufficiently protected location that was accessible via the web interface

The advisory is shared at github.com. This vulnerability is known as CVE-2025-67303 since 12/08/2025. The exploitation appears to be easy. The attack can be launched remotely. Neither technical details nor an exploit are publicly available.

Upgrading to version 3.38 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• ComfyUI-Manager

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20
• 3.21
• 3.22
• 3.23
• 3.24
• 3.25
• 3.26
• 3.27
• 3.28
• 3.29
• 3.30
• 3.31
• 3.32
• 3.33
• 3.34
• 3.35
• 3.36
• 3.37

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Duplicate

• Submit #XXXXXX: Xxxxxxx Xxxxxxx-xxxxxxx <= Xx.xx.x X.x (xxxxxxxx) (by nn0nkey)

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion