Skip to content

Path traversal in LoadImage via the /prompt API allows arbitrary file existence probing and image exfiltration

High
mattmillerai published GHSA-rvxv-29p8-pxgq Jul 15, 2026

Package

pip ComfyUI (pip)

Affected versions

< 0.28.0

Patched versions

0.28.0

Description

Summary

A crafted workflow submitted to the unauthenticated POST /prompt API can make LoadImage (and sibling annotated-filepath nodes) read files outside the input directory.

Details

LoadImage defines a VALIDATE_INPUTS method, which causes the execution engine to skip COMBO (input-directory) validation. The only remaining guard, folder_paths.exists_annotated_filepath / get_annotated_filepath, joined the user-controlled name to the base directory with no containment check, so ../ sequences escaped it. Affected nodes include LoadImage, LoadImageMask, LoadImageOutput, LoadAudio, LoadLatent, LoadVideo, and Load3D.

Impact

A file-existence oracle (existing files return HTTP 200, missing files HTTP 400) for reconnaissance of arbitrary host paths, plus exfiltration of any image-format file by chaining LoadImage to an output/preview node and retrieving it via /view.

Patches

Fixed in ComfyUI v0.28.0: get_annotated_filepath and exists_annotated_filepath reject paths that escape base_dir (realpath + commonpath).

Workarounds

Do not expose the /prompt API to untrusted clients or accept untrusted workflows.

Severity

High

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVE ID

CVE-2026-56673

Weaknesses

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Learn more on MITRE.

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. Learn more on MITRE.

Credits