CVE-2026-92816 Overview
CVE-2026-92816 is a path traversal vulnerability [CWE-22] in ComfyUI versions prior to 0.30.0. The dataset save nodes fail to sanitize the folder_name input parameter, allowing attackers to write files to arbitrary paths outside the intended output directory. An attacker who convinces a user to load a crafted workflow can write attacker-controlled content to sensitive locations. This enables code execution by overwriting startup files or Python package initializers loaded by the ComfyUI process or the user's environment.
Critical Impact
A crafted ComfyUI workflow can write arbitrary files outside the output directory, leading to local code execution when modified startup scripts or package initializers are subsequently loaded.
Affected Products
- ComfyUI versions prior to 0.30.0
- ComfyUI comfy_extras/nodes_dataset.py dataset save nodes
- Workflow environments that load third-party ComfyUI workflow JSON files
Discovery Timeline
- 2026-09-16 - CVE-2026-92816 published to the National Vulnerability Database
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-92816
Vulnerability Analysis
ComfyUI is a node-based interface for building generative AI pipelines. The dataset save nodes defined in comfy_extras/nodes_dataset.py accept a folder_name parameter that is concatenated onto the output directory path without validation. Because the input is treated as trusted, a workflow can supply directory traversal sequences such as ../ or absolute path fragments to redirect writes outside the sandboxed output area.
The attack requires user interaction: a victim must load a malicious workflow file. Once loaded and executed, the node writes attacker-supplied bytes to the target path. Overwriting files such as user shell startup scripts, Python __init__.py modules, or ComfyUI custom node loaders converts the write primitive into code execution the next time those files are read.
Root Cause
The root cause is missing input sanitization on the folder_name field passed to dataset save nodes. The affected implementation in comfy_extras/nodes_dataset.py (see lines 303-318 of the v0.24.0 tree) constructs a destination path from user-controlled input without normalizing the result or verifying that it remains within the configured output root. Version 0.30.0 introduces path validation that constrains writes to the intended directory.
Attack Vector
Exploitation is local and requires user interaction. The attacker distributes a ComfyUI workflow JSON that references a dataset save node with a traversal payload in folder_name. When the victim opens and runs the workflow, ComfyUI writes attacker-controlled file contents to the resolved path. Subsequent execution of the overwritten file, whether at shell startup, Python import, or ComfyUI custom node discovery, executes the payload with the privileges of the ComfyUI user.
No authenticated code snippet is published with the advisory. Technical details are available in the ComfyUI Dataset Node Code and the VulnCheck Advisory for ComfyUI.
Detection Methods for CVE-2026-92816
Indicators of Compromise
- Files created by the ComfyUI process outside of the configured output/ directory tree.
- Workflow JSON files containing folder_name values with ../, absolute paths, or encoded traversal sequences.
- Recent modifications to shell startup files (.bashrc, .zshrc, .profile) or Python __init__.py modules on hosts running ComfyUI.
- Unexpected files written under site-packages, ComfyUI custom_nodes/, or user home directories originating from the ComfyUI process.
Detection Strategies
- Monitor file creation events where the parent process is ComfyUI (Python) and the target path resolves outside the declared output directory.
- Parse workflow files at ingestion time and reject or flag nodes whose folder_name field contains traversal patterns or absolute paths.
- Establish baseline file integrity for user startup scripts and Python package directories and alert on writes attributed to ComfyUI.
Monitoring Recommendations
- Enable endpoint telemetry that captures process-to-file write events for the Python interpreter hosting ComfyUI.
- Log all workflow load events, including the source of the workflow file and the user account executing it.
- Alert on ComfyUI child processes spawned from shells or interpreters shortly after a workflow execution completes.
How to Mitigate CVE-2026-92816
Immediate Actions Required
- Upgrade ComfyUI to version 0.30.0 or later, which sanitizes the folder_name input in dataset save nodes.
- Audit hosts for suspicious files written by ComfyUI outside the output directory and restore any modified startup or package initializer files.
- Restrict the ComfyUI process to a dedicated, unprivileged user account with limited filesystem write scope.
Patch Information
The fix is included in ComfyUI 0.30.0. Review the corrected implementation in the ComfyUI Dataset Node Documentation and track upstream releases in the ComfyUI GitHub Repository. Additional context is available in the VulnCheck Advisory for ComfyUI and the Geo Chen ComfyUI Guide.
Workarounds
- Only load ComfyUI workflows from trusted sources and inspect workflow JSON files before executing them.
- Run ComfyUI inside a container or sandbox with a read-only root filesystem and a writable bind mount limited to the output directory.
- Apply mandatory access controls (AppArmor, SELinux) that prevent the ComfyUI process from writing to home directories, site-packages, and shell startup files.
- Remove or disable dataset save nodes in environments where they are not required until the upgrade is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
