CVE-2026-84702: FaceFusion Path Traversal Vulnerability

CVE-2026-84702 Overview

CVE-2026-84702 is a path traversal vulnerability in FaceFusion through version 3.6.1. The flaw resides in the get_job_file_name function within facefusion/jobs/job_manager.py, which fails to normalize job identifiers before constructing file paths. Attackers can supply directory traversal sequences in the job identifier parameter through the unauthenticated HTTP API to write files outside the intended jobs directory. Successful exploitation allows arbitrary file creation at attacker-controlled locations on the host filesystem. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Unauthenticated remote attackers can write files to arbitrary filesystem locations by injecting traversal sequences into job identifiers, enabling configuration tampering and potential code execution paths.

Affected Products

FaceFusion versions up to and including 3.6.1
FaceFusion job_manager.py component
Fixed in FaceFusion 3.7.0

Discovery Timeline

2026-09-02 - CVE-2026-84702 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84702

Vulnerability Analysis

The vulnerability exists in FaceFusion's job management subsystem. The get_job_file_name function accepts a job identifier from user input and concatenates it directly into a filesystem path without applying canonicalization or validation. When the HTTP API receives a job creation or update request, the identifier is used to derive the target file name for job persistence.

Because FaceFusion's HTTP API is unauthenticated by default, any network-reachable client can invoke the affected code path. The lack of input normalization means sequences such as ../ traverse upward from the jobs directory. This allows attackers to overwrite or create files anywhere the FaceFusion process has write permissions.

Root Cause

The root cause is missing path canonicalization in get_job_file_name. The function trusts the raw job identifier string and does not verify that the resulting resolved path remains within the intended jobs directory. There is no allowlist filter for identifier characters and no check comparing the resolved absolute path against the jobs base directory.

Attack Vector

An attacker sends a crafted HTTP request to the FaceFusion API containing a job identifier with embedded traversal sequences. The application resolves this path relative to the jobs directory and writes attacker-supplied JSON content to the resulting location. Targets of interest include application configuration files such as facefusion.ini, Python module directories for code execution pivots, or startup scripts. No authentication or user interaction is required.

python

# Security patch in facefusion/app_context.py - 3.7.0 (#1175)
def detect_app_context() -> AppContext:
	jobs_path = os.path.join('facefusion', 'jobs')
	uis_path = os.path.join('facefusion', 'uis')
	frame = sys._getframe(1)

	while frame:
		if jobs_path in frame.f_code.co_filename:
			return 'cli'
		if uis_path in frame.f_code.co_filename:
			return 'ui'
		frame = frame.f_back
	return 'cli'

Source: GitHub Commit a2cbfd7. The patch refactors context detection and is part of the broader 3.7.0 fix that normalizes job identifiers.

Detection Methods for CVE-2026-84702

Indicators of Compromise

HTTP requests to FaceFusion API endpoints containing ../, ..%2f, or URL-encoded traversal sequences in job identifier parameters.
Unexpected files appearing outside the facefusion/jobs directory with JSON content matching FaceFusion job schema.
Modifications to facefusion.ini or Python source files under the FaceFusion installation directory without a corresponding administrative action.
Job identifiers in application logs containing non-alphanumeric characters, path separators, or dot sequences.

Detection Strategies

Deploy web application firewall rules that inspect FaceFusion API request bodies and query parameters for path traversal patterns.
Monitor filesystem events on hosts running FaceFusion for file creation outside the jobs directory by the FaceFusion process.
Correlate inbound HTTP requests to the FaceFusion listener with subsequent file writes to sensitive paths.

Monitoring Recommendations

Enable verbose HTTP access logging for the FaceFusion service and forward logs to a centralized analytics platform.
Alert on any process spawned by the FaceFusion Python interpreter that reads or writes outside the installation and jobs directories.
Track version strings reported by FaceFusion instances to identify hosts still running 3.6.1 or earlier.

How to Mitigate CVE-2026-84702

Immediate Actions Required

Upgrade FaceFusion to version 3.7.0 or later, which includes the fix in commit a2cbfd7.
Restrict network access to the FaceFusion HTTP API using host firewalls or reverse proxy allowlists until patching is complete.
Run the FaceFusion process under a dedicated low-privilege account with write access limited to the jobs directory.
Audit the filesystem for unauthorized files created since the FaceFusion service was exposed.

Patch Information

The fix is available in FaceFusion Release 3.7.0. The corrective changes are documented in GitHub Commit a2cbfd7. Additional advisory details are published in the VulnCheck Advisory for FaceFusion.

Workarounds

Place FaceFusion behind an authenticating reverse proxy that validates job identifier parameters against an alphanumeric allowlist.
Deploy filesystem access controls such as AppArmor or SELinux profiles restricting FaceFusion writes to the jobs directory only.
Disable the HTTP API entirely and use FaceFusion through the command-line interface where the network attack surface is not required.

bash

# Example reverse proxy filter blocking traversal in job identifiers
location /api/jobs/ {
    if ($request_uri ~* "(\.\./|\.\.%2f|%2e%2e/)") {
        return 403;
    }
    proxy_pass http://127.0.0.1:7860;
}