Comfy-Org ComfyUI up to 0.29.x Dataset Save Nodes folder_name path traversal

Summaryinfo

A vulnerability was found in Comfy-Org ComfyUI up to 0.29.x. It has been classified as critical. This issue affects some unknown processing of the component Dataset Save Nodes. This manipulation of the argument folder_name causes path traversal. This vulnerability is handled as CVE-2026-92816. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in Comfy-Org ComfyUI up to 0.29.x and classified as critical. Affected by this vulnerability is an unknown code block of the component Dataset Save Nodes. The manipulation of the argument folder_name with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

ComfyUI before 0.30.0 fails to sanitize folder_name input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through modified startup files or package initializers.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-92816 since 09/16/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

Upgrading to version 0.30.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-81074). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Comfy-Org

Name

• ComfyUI

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion