CVE-2026-56671

{"id": "CVE-2026-56671", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56671", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-31T23:18:53.402759Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Comfy-Org", "product": "ComfyUI", "versions": [{"status": "affected", "version": "< 0.28.0"}]}]}], "published": "2026-07-31T06:16:29.860", "references": [{"url": "https://github.com/Comfy-Org/ComfyUI/pull/14734", "source": "security-advisories@github.com"}, {"url": "https://github.com/Comfy-Org/ComfyUI/releases/tag/v0.28.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/Comfy-Org/ComfyUI/security/advisories/GHSA-pj59-g5vv-74q4", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, get_model_preview in app/model_manager.py joins an unrestricted filename route capture to a selected model directory without a containment check, allowing an unauthenticated remote attacker to use traversal, encoded traversal, absolute paths, or an unbounded path_index to read image-decodable files and enumerate host paths. get_model_preview (app/model_manager.py) built the path with os.path.join(folder, filename) where filename is an unrestricted {filename:.*} route capture. Literal ../, percent-encoded %2e%2e%2f, and absolute paths all escaped the model directory; path_index was also unbounded. The target file is piped through Pillow and re-encoded as WEBP, so disclosure is limited to image-decodable files plus a file-existence/enumeration oracle (and internal-path leakage via path_index errors). This issue is fixed in version 0.28.0."}, {"lang": "es", "value": "ComfyUI es una GUI modular de modelo de difusi\u00f3n, API y backend con una interfaz de grafo/nodos. Antes de la versi\u00f3n 0.28.0, get_model_preview en app/model_manager.py une una captura de ruta de nombre de archivo sin restricciones a un directorio de modelo seleccionado sin una verificaci\u00f3n de contenci\u00f3n, permitiendo a un atacante remoto no autenticado usar recorrido, recorrido codificado, rutas absolutas o un path_index ilimitado para leer archivos decodificables como imagen y enumerar rutas de host. get_model_preview (app/model_manager.py) construy\u00f3 la ruta con os.path.join(folder, filename) donde filename es una captura de ruta {filename:.*} sin restricciones. .. / literal, %2e%2e%2f codificado en porcentaje y rutas absolutas escaparon del directorio del modelo; path_index tambi\u00e9n era ilimitado. El archivo objetivo se canaliza a trav\u00e9s de Pillow y se recodifica como WEBP, por lo que la divulgaci\u00f3n se limita a archivos decodificables como imagen m\u00e1s un or\u00e1culo de existencia/enumeraci\u00f3n de archivos (y fuga de rutas internas a trav\u00e9s de errores de path_index). Este problema est\u00e1 solucionado en la versi\u00f3n 0.28.0."}], "lastModified": "2026-10-23T23:10:00.157", "sourceIdentifier": "security-advisories@github.com"}