CVE-2026-77815: Stable Diffusion WebUI Information Disclosure

CVE-2026-77815 Overview

CVE-2026-77815 is a symbolic link path traversal vulnerability [CWE-59] in the Infinite Image Browsing (IIB) extension for Stable Diffusion WebUI. The flaw resides in the to_abs_path function within scripts/iib/tool.py, which normalizes requested paths using os.path.normpath. This function collapses dot segments but does not resolve symbolic links. An attacker can place a symlink inside a scanned image directory that targets files outside the trusted scope, such as /etc/passwd. The containment check in is_path_trusted accepts the path, and FileResponse follows the link when serving the response.

Critical Impact

Remote unauthenticated attackers can read arbitrary readable files on the host system when access control is active, or any readable file in standalone deployments regardless of the flaw.

Affected Products

• Infinite Image Browsing (zanllp/infinite-image-browsing) versions up to and including v1.8.0
• Stable Diffusion WebUI deployments with the IIB extension installed
• Network-exposed WebUI instances launched with share, ngrok, listen, or server_name options

Discovery Timeline

• 2026-08-21 - CVE-2026-77815 published to NVD
• 2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-77815

Vulnerability Analysis

The vulnerability stems from the incorrect use of os.path.normpath for path canonicalization in to_abs_path. This Python function only resolves logical path components such as .. and . segments. It does not follow or resolve symbolic links on the filesystem. When is_path_trusted in scripts/iib/api.py compares the normalized path against the list of scanned parent directories, a symlink placed within an authorized directory passes the string prefix check.

The FastAPI FileResponse handler subsequently resolves the symlink at the operating system level and returns the contents of the target file. An attacker with write access to a scanned image directory, or one who influences user-supplied paths, can exfiltrate arbitrary readable files.

Root Cause

The root cause is a mismatch between logical path normalization and filesystem-level symlink resolution. os.path.normpath produces a canonical string, but the underlying open() call follows symlinks transparently. Confinement depends on get_enable_access_control, which returns true when IIB_ACCESS_CONTROL is set to enable, false when disable, and otherwise defaults based on WebUI launch flags. Standalone deployments without those flags serve every readable file regardless of the check.

Attack Vector

An attacker with the ability to create a symlink inside a scanned image directory targets a sensitive file. A request to the IIB API endpoint that serves files with that symlink path returns the contents of the linked file over the network without authentication.

# Vulnerable code in scripts/iib/tool.py (pre-patch)
def to_abs_path(path):
    if not os.path.isabs(path):
        path = os.path.join(os.getcwd(), path)
    return os.path.normpath(path)  # Does not resolve symlinks

Source: GitHub Commit 4057a624

Detection Methods for CVE-2026-77815

Indicators of Compromise

• Unexpected symbolic links present in Stable Diffusion WebUI image output directories or user-configured scan paths
• HTTP requests to IIB /file or /image endpoints referencing paths that resolve outside configured image directories
• Access log entries showing responses containing content from system files such as /etc/passwd, SSH keys, or configuration files

Detection Strategies

• Audit scanned directories for symbolic links using find <scan_dir> -type l and validate their targets
• Monitor Stable Diffusion WebUI process file descriptors for reads outside intended image directories
• Inspect IIB API request logs for path parameters containing traversal patterns or referencing files with sensitive extensions

Monitoring Recommendations

• Enable filesystem auditing (auditd on Linux) on directories exposed through IIB to detect symlink creation events
• Alert on outbound HTTP responses from WebUI that exceed typical image payload sizes or contain text/plain content types
• Track invocations of FileResponse in application logs correlated with paths outside the configured allowlist

How to Mitigate CVE-2026-77815

Immediate Actions Required

• Upgrade Infinite Image Browsing to the version containing commit 4057a624c7a23a36f0b4dc6a545b40767d602450 or later
• Set the environment variable IIB_ACCESS_CONTROL=enable to force access control on all deployments, including standalone runs
• Remove any existing symbolic links from directories configured as IIB scan paths and restrict write permissions to those directories

Patch Information

The fix was merged via Pull Request #969 and replaces os.path.normpath with os.path.realpath in to_abs_path. The patch also adds os.path.realpath resolution for parent paths in is_path_trusted and enforces a directory separator boundary on the prefix comparison to prevent partial-name matches.

# Patched code in scripts/iib/tool.py
def to_abs_path(path):
    if not os.path.isabs(path):
        path = os.path.join(os.getcwd(), path)
    return os.path.realpath(path)

# Patched code in scripts/iib/api.py
parent_paths = mem["all_scanned_paths"]
path = to_abs_path(path)
for parent_path in parent_paths:
    parent_path = os.path.realpath(parent_path)
    if len(path) <= len(parent_path):
        if parent_path.startswith(path):
            return True
    else:
        if path.startswith(parent_path + os.sep):
            return True

Source: GitHub Commit 4057a624

Workarounds

• Do not expose Stable Diffusion WebUI to untrusted networks; avoid --share, --ngrok, --listen, and --server-name flags until patched
• Run the WebUI process under a low-privilege user account with restricted read access to sensitive files
• Place scanned image directories on a dedicated filesystem or use mount options such as nosymfollow to prevent symlink traversal

# Configuration example: enforce access control and audit for symlinks
export IIB_ACCESS_CONTROL=enable
find /path/to/stable-diffusion/outputs -type l -exec ls -la {} \;
chmod -R go-w /path/to/stable-diffusion/outputs