CVE-2025-6092: ComfyUI XSS Vulnerability via Image Upload

CVE-2025-6092 Overview

CVE-2025-6092 is a cross-site scripting (XSS) vulnerability affecting ComfyUI by comfyanonymous, in versions up to and including 0.3.39. The flaw resides in the /upload/image endpoint and represents an incomplete fix for the earlier CVE-2024-10099. Attackers can manipulate the image argument to inject scripts that execute in the context of the user's browser. The issue is classified under [CWE-79] and can be triggered remotely, though it requires user interaction. The exploit has been publicly disclosed. The vendor was contacted prior to disclosure but did not respond.

Critical Impact
Remote attackers can inject arbitrary JavaScript through the ComfyUI image upload endpoint, enabling session data theft, UI manipulation, and phishing against authenticated users.

Affected Products

comfyanonymous ComfyUI versions up to 0.3.39
The /upload/image component of ComfyUI
Deployments carrying the incomplete fix for CVE-2024-10099

Discovery Timeline

2025-06-15 - CVE-2025-6092 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6092

Vulnerability Analysis

ComfyUI is an open-source, node-based graphical interface for Stable Diffusion workflows. The /upload/image route accepts image files submitted by users and returns metadata used by the front end. The vulnerability arises because the original patch for CVE-2024-10099 did not fully neutralize attacker-controlled input in the image parameter. When the front end later renders values derived from this parameter, injected markup executes in the browser session of the viewing user.

The EPSS score is 0.32%, indicating a low observed likelihood of exploitation activity. Exploitation requires the victim to interact with a crafted upload or the resulting UI element. Because ComfyUI is often exposed on internal or self-hosted infrastructure with cached credentials and workflow assets, a successful XSS payload can pivot into workflow tampering or credential harvesting.

Root Cause

The root cause is insufficient input sanitization and output encoding of the image parameter accepted by the /upload/image endpoint. The prior fix addressed only a subset of injection vectors, leaving payloads that use alternate encodings or attribute contexts unfiltered. This qualifies as an incomplete fix pattern where the original CWE-79 condition remains reachable.

Attack Vector

An attacker crafts a malicious upload request or lures an authenticated ComfyUI user to submit an image whose filename or metadata contains an XSS payload. When the ComfyUI web interface later renders the affected value, the injected script executes with the privileges of the current user. Public proof-of-concept material has been shared via a GitHub Gist PoC Resource and cataloged in VulDB #312559.

Detection Methods for CVE-2025-6092

Indicators of Compromise

HTTP POST requests to /upload/image containing HTML tags, <script>, onerror=, or javascript: sequences in the image parameter or filename.
Uploaded image records whose filenames or metadata fields contain URL-encoded angle brackets or event handler attributes.
Browser console errors or unexpected outbound requests originating from the ComfyUI web UI after loading a workflow gallery.

Detection Strategies

Inspect web server and reverse proxy logs for anomalous payloads submitted to the ComfyUI /upload/image route.
Apply Web Application Firewall (WAF) signatures for reflected and stored XSS patterns on multipart upload endpoints.
Correlate authenticated user sessions with upload activity to identify unusual filename patterns preceding suspicious client-side behavior.

Monitoring Recommendations

Enable HTTP request logging with full URI and body captures for the ComfyUI service.
Alert on Content Security Policy (CSP) violation reports if CSP is configured in front of ComfyUI.
Monitor authenticated user sessions for post-upload activity that deviates from workflow baselines.

How to Mitigate CVE-2025-6092

Immediate Actions Required

Restrict network exposure of ComfyUI to trusted users and internal networks only, using VPN or authenticated reverse proxy access.
Disable or block anonymous access to the /upload/image endpoint until a fixed version is deployed.
Audit existing uploads for filenames and metadata containing HTML or script content and remove offending records.

Patch Information

At the time of publication, no vendor patch has been referenced in the NVD entry and the vendor did not respond to disclosure attempts. Administrators should monitor the ComfyUI project for updates beyond version 0.3.39 and apply any subsequent releases addressing the incomplete fix for CVE-2024-10099. Consult VulDB CTI ID #312559 for tracking updates.

Workarounds

Place ComfyUI behind a reverse proxy that enforces a strict Content Security Policy limiting inline script execution.
Deploy WAF rules that reject upload requests where filenames or the image parameter contain HTML control characters.
Sanitize server-stored filenames by renaming uploads to server-generated identifiers before persisting to disk or database.

bash

# Example NGINX reverse proxy rule to block obvious XSS payloads in upload filenames
location /upload/image {
    if ($request_body ~* "(<script|onerror=|javascript:|<img[^>]+src=)") {
        return 403;
    }
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'";
    proxy_pass http://comfyui_backend;
}