CVE-2026-123790: Unauthenticated Path Traversal in ComfyUI-Easy-Use Allows Remote Code Execution
ComfyUI-Easy-Use version 1.3.6 contains a path traversal vulnerability in the savepreview() handler for POST /easyuse/save/{name}. The handler checks the source directory before appending a user-supplied filename and allows the request to select the customnodes directory as a copy destination. An unauthenticated attacker who can reach the ComfyUI server can overwrite an installed custom node’s Python entry point with an uploaded file. When ComfyUI restarts and loads the modified node, the attacker’s code runs with the privileges of the ComfyUI process.
Event History
Frequently Asked Questions
Who is exposed to exploitation?
ComfyUI-Easy-Use 1.3.6 deployments are exposed if an unauthenticated attacker can reach the ComfyUI server.
What does an attacker need to do to achieve code execution?
The attacker must send a POST request to /easyuse/save/{name} that abuses the filename handling to overwrite an installed custom node's Python entry point with an uploaded file. Code executes when ComfyUI restarts and loads the modified node.
Does exploitation require authentication or existing access to the server?
No. The issue is described as unauthenticated; network reachability to the ComfyUI server is the stated prerequisite.
What happens if the vulnerability is successfully exploited?
An attacker can replace a custom node's Python entry point. On the next ComfyUI restart, the replacement code runs with the privileges of the ComfyUI process.