CVE-2024-21575: Path Traversal
ComfyUI-Impact-Pack is vulnerable to Path Traversal. The issue stems from missing validation of the image.filename field in a POST request sent to the /upload/temp endpoint added by the extension to the server. This results in writing arbitrary files to the file system which may, under some conditions, result in remote code execution (RCE).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21575?
CVE-2024-21575 is considered a high severity vulnerability due to its potential for arbitrary file write operations.
How do I fix CVE-2024-21575?
To fix CVE-2024-21575, implement proper validation on the 'image.filename' field in the POST request to prevent path traversal.
What types of systems are affected by CVE-2024-21575?
CVE-2024-21575 affects systems running the ComfyUI Impact Pack that accept inputs from the '/upload/temp' endpoint.
What could happen if CVE-2024-21575 is exploited?
Exploitation of CVE-2024-21575 could lead to unauthorized writing of files to the server's file system, which can compromise security.
Is there a specific version of the ComfyUI Impact Pack affected by CVE-2024-21575?
CVE-2024-21575 affects all versions of ComfyUI Impact Pack that include the vulnerable '/upload/temp' endpoint.