CVE-2026-77814: Stable Diffusion WebUI Path Traversal

CVE-2026-77814 Overview

CVE-2026-77814 is a path traversal vulnerability [CWE-22] in the Infinite Image Browsing extension for Stable Diffusion WebUI. The is_path_trusted function in scripts/iib/api.py compares a requested path against each allowed parent directory using path.startswith(parent_path) without appending a path separator. A directory whose name merely begins with an allowed path satisfies the comparison. Where /data/images is allowed, a request for /data/images_private/secret.txt is treated as trusted and served by FileResponse, disclosing files the confinement was meant to exclude.

Critical Impact
Unauthenticated attackers reaching a network-exposed Infinite Image Browsing endpoint can read arbitrary files whose paths share a prefix with any whitelisted directory.

Affected Products

Infinite Image Browsing (zanllp/infinite-image-browsing) through version 1.8.0
Stable Diffusion WebUI deployments loading the extension with share, ngrok, listen, or server_name
Deployments where IIB_ACCESS_CONTROL is set to enable

Discovery Timeline

2026-08-21 - CVE-2026-77814 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-77814

Vulnerability Analysis

The flaw resides in the trusted-path check that gates the FileResponse handler in Infinite Image Browsing. The is_path_trusted routine iterates over parent directories in mem["all_scanned_paths"] and evaluates whether the requested absolute path begins with any allowed prefix. Because the comparison omits a trailing os.sep, sibling directories that share a prefix with a whitelisted directory pass the check.

Applicability depends on get_enable_access_control in scripts/iib/tool.py. It returns true when IIB_ACCESS_CONTROL=enable, false when set to disable, and otherwise true when the host WebUI was started with share, ngrok, listen, or server_name. Confinement is therefore active in the network-exposed deployments that rely on it. Standalone runs without those options serve every readable file regardless of the flaw.

Root Cause

The prefix comparison treats path strings as opaque text rather than filesystem components. /data/images matches /data/images_private because Python string startswith does not recognize directory boundaries. Adding os.sep to the parent forces boundary-aware comparison.

Attack Vector

A remote attacker sends a crafted request to the extension's file-serving endpoint referencing a path that begins with a whitelisted directory name but resolves into a sibling directory. The server returns the file contents through FileResponse, disclosing files outside the intended confinement.

python

            parent_paths = mem["all_scanned_paths"]
            path = to_abs_path(path)
            for parent_path in parent_paths:
+               parent_path = os.path.realpath(parent_path)
                if len(path) <= len(parent_path):
                    if parent_path.startswith(path):
                        return True
                else:
-                   if path.startswith(parent_path):
+                   if path.startswith(parent_path + os.sep):
                        return True
        except:
            pass

Source: GitHub Commit #4057a624 — the patch appends os.sep to the parent path before the startswith check and normalizes both sides with os.path.realpath.

Detection Methods for CVE-2026-77814

Indicators of Compromise

HTTP requests to Infinite Image Browsing file endpoints containing path components that share a prefix with a configured scan directory but reference a sibling directory (for example, images_private when images is allowed).
FileResponse server log entries returning files from directories outside the intended all_scanned_paths set.
Unexpected outbound reads of sensitive configuration or credential files co-located near whitelisted image directories.

Detection Strategies

Inspect access logs for requests to Infinite Image Browsing API routes referencing absolute paths outside the operator-configured directories.
Compare served file paths against the configured all_scanned_paths list and alert on any file served from a sibling directory.
Review deployment configuration for the presence of share, ngrok, listen, or server_name combined with an unpatched extension version.

Monitoring Recommendations

Enable web access logging on the Stable Diffusion WebUI host and forward events to a centralized log store for retention and query.
Alert on anomalous file-read volume or unusual filename patterns emitted by the extension endpoint.
Track process command lines for webui.py invocations that expose the service to untrusted networks.

How to Mitigate CVE-2026-77814

Immediate Actions Required

Update Infinite Image Browsing to the version containing commit 4057a624c7a23a36f0b4dc6a545b40767d602450 from Pull Request #969.
Set IIB_ACCESS_CONTROL=disable only if the host is not network-exposed; otherwise leave enforcement enabled and apply the patch.
Restrict network access to the WebUI to authenticated users on trusted networks.

Patch Information

The fix in commit 4057a624 modifies is_path_trusted to compare against parent_path + os.sep and updates to_abs_path to use os.path.realpath instead of os.path.normpath, resolving symbolic links before validation. See the VulnCheck Security Advisory for background and the vulnerable code in v1.8.0.

Workarounds

Avoid whitelisting directories that share name prefixes with sensitive sibling directories on the same host.
Run the WebUI behind a reverse proxy that requires authentication and terminates untrusted traffic.
Do not launch the WebUI with --share, --listen, --server-name, or --ngrok while the extension remains unpatched.

bash

# Configuration example
cd stable-diffusion-webui/extensions/infinite-image-browsing
git fetch origin
git checkout 4057a624c7a23a36f0b4dc6a545b40767d602450
export IIB_ACCESS_CONTROL=enable