CVE-2026-84702: facefusion before 3.7.0 Path Traversal via Job Identifier
Published Sep 2, 2026
·Updated
facefusion through 3.6.1 fails to normalize job identifiers in getjobfilename, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations.
Affected Software
1 affected component
facefusion<3.7.0
Event History
Sep 2, 2026
CVE Published
via MITRE·12:37 AM
Data Sourced
via MITRE·12:37 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are exposed to remote attack?
Deployments running facefusion through version 3.6.1 that expose the unauthenticated HTTP API are exposed. An attacker can submit a crafted job identifier through that API.
2
Does exploitation require credentials or user interaction?
No. The affected HTTP API is unauthenticated, and the reported vector requires neither privileges nor user interaction.
3
What is the affected version range and remediation target?
facefusion versions through 3.6.1 are affected. The issue is described as fixed in version 3.7.0 or later.