CVE-2025-67303: ComfyUI-Manager Information Disclosure Flaw

CVE-2025-67303 Overview

A significant security vulnerability has been identified in ComfyUI-Manager prior to version 3.38 that allows remote attackers to potentially manipulate application configuration and critical data. The vulnerability stems from the application storing its files in an insufficiently protected location that is accessible via the web interface, creating an attack surface for unauthorized modification of sensitive settings.

Critical Impact

Remote attackers can manipulate ComfyUI-Manager configuration and critical data without authentication due to improper protection of web-accessible storage locations.

Affected Products

• ComfyUI-Manager versions prior to 3.38

Discovery Timeline

• 2026-01-05 - CVE-2025-67303 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-67303

Vulnerability Analysis

This vulnerability is classified under CWE-420 (Unprotected Alternate Channel), which occurs when a product protects a primary communication channel but fails to protect an alternate channel that provides the same access to sensitive resources. In the case of ComfyUI-Manager, the application stores critical configuration files and data in a location that, while potentially protected through normal access controls, remains accessible through the web interface without adequate authorization checks.

The network-based attack vector means exploitation can occur remotely without requiring any user interaction or prior authentication. This creates a significant risk for deployments where ComfyUI-Manager is exposed to untrusted networks or the internet. While the vulnerability does not directly impact system confidentiality or availability, the high integrity impact means attackers can modify critical application data and configurations.

Root Cause

The root cause of this vulnerability is improper access control implementation for file storage locations. ComfyUI-Manager stored its configuration files and critical data in directories that were inadvertently exposed through the web interface. This design flaw allowed unauthenticated remote users to access and potentially modify these files, bypassing intended security boundaries. The application failed to implement proper isolation between web-accessible resources and sensitive configuration data.

Attack Vector

The attack vector is network-based, allowing remote exploitation without authentication. An attacker with network access to a vulnerable ComfyUI-Manager instance can interact with the web interface to access and modify configuration files that should be protected. The attack requires no special privileges or user interaction, making it particularly dangerous in environments where ComfyUI-Manager is accessible from untrusted networks.

The exploitation process involves identifying exposed file storage paths through the web interface and crafting requests to read or modify configuration data. Since no authentication is required, attackers can systematically probe for and manipulate sensitive settings, potentially leading to further compromise of the system or disruption of normal operations.

Detection Methods for CVE-2025-67303

Indicators of Compromise

• Unexpected modifications to ComfyUI-Manager configuration files or userdata directories
• Unusual HTTP requests targeting configuration file paths through the web interface
• Changes to application behavior or settings that were not initiated by administrators
• Web server logs showing access attempts to sensitive file paths from external IP addresses

Detection Strategies

• Review web server access logs for suspicious requests targeting configuration directories
• Implement file integrity monitoring on ComfyUI-Manager configuration and data directories
• Deploy web application firewall (WAF) rules to detect and block unauthorized file access attempts
• Monitor for anomalous network traffic patterns to ComfyUI-Manager instances

Monitoring Recommendations

• Enable detailed access logging for the ComfyUI-Manager web interface
• Set up alerts for configuration file modifications outside of normal maintenance windows
• Implement network segmentation to limit exposure of ComfyUI-Manager to trusted networks only
• Regularly audit file permissions and web interface access controls

How to Mitigate CVE-2025-67303

Immediate Actions Required

• Upgrade ComfyUI-Manager to version 3.38 or later immediately
• Restrict network access to ComfyUI-Manager instances to trusted networks only
• Review and audit any configuration changes that may have occurred prior to patching
• Implement additional access controls or authentication layers in front of the web interface

Patch Information

The Comfy-Org development team has addressed this vulnerability in ComfyUI-Manager version 3.38. The fix involves a security migration that properly protects user data and configuration files from unauthorized web interface access. Administrators should review the Comfy-Org Security Migration Guide for detailed upgrade instructions and follow the migration process to ensure proper security hardening.

The specific changes can be reviewed in the Comfy-Org Pull Request Commits which detail the security improvements implemented.

Workarounds

• Deploy ComfyUI-Manager behind a reverse proxy with authentication requirements
• Implement network-level access controls (firewall rules) to restrict access to trusted IP addresses only
• Manually relocate sensitive configuration files to protected directories outside the web root
• If upgrade is not immediately possible, consider temporarily disabling network access until patching is complete

# Configuration example - Restrict network access via firewall
# Allow only trusted network to access ComfyUI-Manager port (example: port 8188)
iptables -A INPUT -p tcp --dport 8188 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8188 -j DROP