CVE-2026-56671 Overview
ComfyUI, a modular diffusion model GUI, API, and backend with a graph/nodes interface, contains a path traversal vulnerability [CWE-22] in versions prior to 0.28.0. The get_model_preview function in app/model_manager.py joins an unrestricted filename route capture to a selected model directory without a containment check. An unauthenticated remote attacker can leverage literal traversal, percent-encoded traversal, or absolute paths to read image-decodable files on the host. The flaw also enables file existence enumeration and internal-path leakage through path_index errors. The maintainers fixed the issue in version 0.28.0.
Critical Impact
Unauthenticated remote attackers can read image-decodable files outside the model directory and enumerate arbitrary host paths.
Affected Products
- ComfyUI versions prior to 0.28.0
- app/model_manager.pyget_model_preview route handler
- Deployments exposing the ComfyUI HTTP interface to untrusted networks
Discovery Timeline
- 2026-07-31 - CVE-2026-56671 published to NVD
- 2026-08-01 - Last updated in NVD database
Technical Details for CVE-2026-56671
Vulnerability Analysis
The vulnerability resides in the get_model_preview handler within app/model_manager.py. The handler constructs a file path using os.path.join(folder, filename), where filename originates from an unrestricted {filename:.*} route capture. The handler does not verify that the resulting path stays within the intended model directory. As a result, attackers can supply crafted path components that traverse to arbitrary locations on the host filesystem.
Because the retrieved file is piped through Pillow and re-encoded as WEBP before being returned, direct disclosure is limited to files that Pillow can decode as images. However, the handler still functions as a file-existence oracle. Distinct error responses reveal whether a path exists, and errors surfaced through the path_index parameter leak internal filesystem paths.
Root Cause
The root cause is the absence of a canonical-path containment check after joining user-controlled input to a trusted directory. The {filename:.*} route pattern accepts any character sequence, including ../, percent-encoded variants such as %2e%2e%2f, and absolute paths. Additionally, the path_index argument is not bounded, which produces informative error output when out-of-range values are supplied.
Attack Vector
An unauthenticated attacker issues an HTTP request to the model preview endpoint with a manipulated filename segment. Using traversal sequences or absolute paths, the attacker directs the server to read files outside the model directory. Image-decodable targets are returned as WEBP content, while non-image targets still produce responses that reveal whether the file exists. See the GitHub Security Advisory for full technical details.
Detection Methods for CVE-2026-56671
Indicators of Compromise
- HTTP requests to the ComfyUI model preview endpoint containing ../, ..\, or percent-encoded traversal sequences such as %2e%2e%2f and %2e%2e/
- Requests to the preview endpoint using absolute filesystem paths, for example beginning with /etc/, /root/, or drive letters on Windows
- Unusually large or out-of-range path_index values in preview requests producing 4xx or 5xx responses
- Bursts of preview requests iterating through predictable filenames, indicating enumeration activity
Detection Strategies
- Inspect web server and reverse proxy logs for preview endpoint requests containing traversal patterns or absolute paths
- Alert on repeated 4xx errors from the preview endpoint originating from a single source, indicative of enumeration
- Correlate high-cardinality filename values or path_index scans against a single client IP within short time windows
Monitoring Recommendations
- Enable verbose access logging on any reverse proxy fronting ComfyUI and forward logs to centralized analytics
- Baseline normal preview request patterns to make traversal probes and enumeration bursts stand out
- Monitor outbound WEBP responses from ComfyUI for anomalously sized payloads that may indicate exfiltration of non-model files
How to Mitigate CVE-2026-56671
Immediate Actions Required
- Upgrade ComfyUI to version 0.28.0 or later, which enforces path containment in get_model_preview
- Restrict network exposure of the ComfyUI service to trusted operators using firewall rules or a reverse proxy with authentication
- Audit recent web logs for traversal patterns and absolute path requests against the preview endpoint
Patch Information
The issue is fixed in ComfyUI 0.28.0. Review the GitHub Pull Request implementing the containment check and the GitHub Release v0.28.0 notes prior to upgrading.
Workarounds
- Place ComfyUI behind an authenticating reverse proxy that blocks unauthenticated access to the model preview route
- Add a proxy-layer filter that rejects requests to the preview endpoint containing .., encoded traversal sequences, or absolute path prefixes
- Run the ComfyUI process under a dedicated low-privilege account with filesystem access limited to its required directories
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
