CVE-2025-6092: comfyanonymous comfyui Incomplete Fix CVE-2024-10099 image cross site scripting
A vulnerability was found in comfyanonymous comfyui up to 0.3.39. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /upload/image of the component Incomplete Fix CVE-2024-10099. The manipulation of the argument image leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6092?
CVE-2025-6092 has been declared as a problematic vulnerability with potential security implications.
How do I fix CVE-2025-6092?
To mitigate CVE-2025-6092, upgrade comfyanonymous comfyui to a version later than 0.3.39.
What component is affected by CVE-2025-6092?
CVE-2025-6092 affects the image upload functionality of comfyanonymous comfyui.
What is the nature of CVE-2025-6092?
CVE-2025-6092 is related to an incomplete fix for the previously identified CVE-2024-10099.
When was CVE-2025-6092 discovered?
CVE-2025-6092 was identified after the vulnerabilities preceding it, specifically after CVE-2024-10099.