CVE-2026-56673 Overview
CVE-2026-56673 is a path traversal vulnerability [CWE-22] in ComfyUI, a modular diffusion model graphical user interface (GUI), API, and backend. Versions prior to 0.28.0 join workflow-controlled annotated filenames to a base directory without a containment check. An unauthenticated attacker can send a crafted POST /prompt workflow using LoadImage or sibling nodes to probe arbitrary host paths and exfiltrate image-format files through the /view endpoint. The LoadImage node defines a VALIDATE_INPUTS method, which causes the execution engine to skip COMBO input-directory validation. The issue is fixed in version 0.28.0.
Critical Impact
Unauthenticated remote attackers can enumerate host filesystem paths and exfiltrate image-format files from ComfyUI servers exposed over the network.
Affected Products
- ComfyUI versions prior to 0.28.0
- Vulnerable nodes: LoadImage, LoadImageMask, LoadImageOutput, LoadAudio
- Vulnerable nodes: LoadLatent, LoadVideo, and Load3D
Discovery Timeline
- 2026-07-31 - CVE-2026-56673 published to the National Vulnerability Database (NVD)
- 2026-07-31 - Last updated in NVD database
Technical Details for CVE-2026-56673
Vulnerability Analysis
The vulnerability resides in two helper functions inside folder_paths: get_annotated_filepath and exists_annotated_filepath. Both functions join a user-supplied annotated filename to a configured base directory, then resolve the combined path without verifying that the result remains inside the intended directory. Attackers supply traversal sequences such as ../ in the annotated filename to escape into arbitrary host paths. The affected loader nodes, including LoadImage, then read those paths during workflow execution. Files that decode as supported image formats become retrievable through the /view HTTP endpoint, enabling exfiltration.
Root Cause
The root cause is missing path containment validation after joining a user-controlled filename with a trusted base directory. ComfyUI also skips the COMBO input-directory validation for nodes that implement a VALIDATE_INPUTS method. LoadImage implements this method, so the execution engine bypasses the standard check that would restrict inputs to files present in the configured input directory.
Attack Vector
An unauthenticated attacker with network reachability to a ComfyUI instance submits a crafted workflow through POST /prompt. The workflow assigns a traversal-laced annotated filename to a vulnerable loader node such as LoadImage. The server resolves the escaped path, and image-format contents are then fetched through /view. The attacker uses this primitive to probe filesystem layout and exfiltrate readable image files across the host.
Refer to the GitHub Security Advisory GHSA-rvxv-29p8-pxgq and the GitHub Pull Request for technical details of the fix.
Detection Methods for CVE-2026-56673
Indicators of Compromise
- HTTP POST /prompt requests whose JSON body contains annotated filename fields with ../, absolute paths, or drive letters targeting loader nodes.
- GET /view requests with filename, subfolder, or type parameters referencing paths outside the configured ComfyUI input, output, or temp directories.
- Access log entries showing repeated /view retrievals from unauthenticated or unexpected client addresses.
Detection Strategies
- Alert on ComfyUI process file reads outside the configured input, output, and temp directories using endpoint file-access telemetry.
- Inspect ComfyUI web-server logs for /prompt payloads containing path traversal patterns targeting LoadImage, LoadAudio, LoadVideo, LoadLatent, or Load3D.
- Correlate POST /prompt submissions followed by GET /view requests referencing unusual filenames from the same source address.
Monitoring Recommendations
- Ingest ComfyUI application logs and reverse-proxy access logs into a centralized data lake for query-based hunting across historical traffic.
- Monitor outbound data volume from ComfyUI hosts to detect bulk retrieval of images through /view.
- Track running ComfyUI versions across the environment and alert when instances remain below 0.28.0.
How to Mitigate CVE-2026-56673
Immediate Actions Required
- Upgrade ComfyUI to version 0.28.0 or later on all hosts, including development and research systems.
- Remove direct internet exposure of ComfyUI and place instances behind authenticated reverse proxies or VPN gateways.
- Review web-server logs since deployment for traversal patterns in /prompt and /view requests and investigate matches.
Patch Information
The maintainers fixed the flaw in ComfyUI 0.28.0. The patch enforces containment checks in get_annotated_filepath and exists_annotated_filepath so resolved paths cannot escape the configured base directories. See the GitHub Release v0.28.0 notes and the GitHub Pull Request that implements the fix.
Workarounds
- Restrict ComfyUI to trusted network segments using host firewall rules or network access control lists until patching completes.
- Terminate POST /prompt and GET /view requests at an authenticating reverse proxy that requires credentials for every request.
- Run ComfyUI under a low-privilege service account with filesystem access limited to its input, output, and model directories.
# Upgrade ComfyUI to a patched release
pip install --upgrade "comfyui>=0.28.0"
# Verify the installed version
python -c "import comfy; print(comfy.__version__)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
