comfyanonymous/comfyui version v0.2.4 suffers from a non-blind Server-Side Request Forgery (SSRF) vulnerability. This vulnerability can be exploited by combining the REST APIs POST /internal/models/download and GET /view, allowing attackers to abuse the victim server's credentials to access unauthorized web resources.

Impact

An Unprotected Alternate Channel (CWE-420) vulnerability was discovered in ComfyUI-Manager versions prior to 3.38.

Vulnerability Details

In affected versions, ComfyUI-Manager stored its configuration in the user/default/ComfyUI-Manager/ directory, which was accessible via ComfyUI's web APIs without proper access control. This unprotected alternate channel allowed remote attackers to read and manipulate configuration files and critical data through the web interface.

Potential Attack Scenarios

An attacker exploiting this vulnerability could: - Modify security settings: Lower the security level from "strong" to "weak" to enable more dangerous operations - Tamper with custom node sources: Add malicious custom node repositories - Manipulate snapshot data: Corrupt or alter system snapshots - Change manager behavior: Alter various manager configuration settings

Affected Configurations

| Configuration | Risk Level | |---------------|------------| | Systems running with --listen 0.0.0.0 (externally exposed) | HIGH | | Systems behind reverse proxy without proper access control | MEDIUM | | Local-only installations (default, localhost only) | NOT AFFECTED |

---

Patches

This issue has been patched in ComfyUI-Manager version 3.38.

Requirements

| Component | Minimum Version | Notes | |-----------|-----------------|-------| | ComfyUI | v0.3.76+ | Required for System User Protection API | | ComfyUI-Manager | v3.38+ | Contains the security fix |

What the Patch Does

1. Path Migration: Configuration files moved from unprotected user/default/ComfyUI-Manager/ to protected user/manager/ 2. Protected Directory: The new manager/ directory leverages ComfyUI's System User Protection API, which blocks external web API access 3. Security Level Enforcement: Settings below "normal" are automatically raised to "normal" during migration 4. Legacy Backup: Old data is backed up to .legacy-manager-backup/ with startup reminders until manually deleted 5. Fallback Protection: If ComfyUI < v0.3.76, Manager forces "strong" security mode, blocking new installations until ComfyUI is updated

Patch Details

- Commit: aaed1dc - Pull Request: ComfyUI-Manager/#2338 ComfyUI/#10966 - Changes: +780 lines, −61 lines across 13 files

---

Workarounds

If immediate upgrade is not possible, apply the following mitigations:

| Mitigation | Effectiveness | Effort | |------------|---------------|--------| | Remove --listen 0.0.0.0 flag (use localhost only) | HIGH | Low | | Implement firewall rules to block external access to ComfyUI ports | HIGH | Medium | | Use reverse proxy with authentication (e.g., nginx + basic auth) | HIGH | Medium | | Restrict network access to trusted IPs only | MEDIUM | Low |

Note: These are temporary mitigations. Upgrading to v3.38+ is strongly recommended.

---

Resources

- NVD - CVE-2025-67303 - ComfyUI-Manager v3.38 Security Migration Guide - Patch Pull Request ComfyUI-Manager/#2338 - Patch Pull Request ComfyUI/#10966

---

Credit

This vulnerability was reported by Ricter Zheng (ricterzheng / 郑杜涛) from Tencent Xuanwu Lab <ricterzheng@tencent.com>

Impact

Vulnerability Type: CRLF Injection via ConfigParser

An attacker can inject special characters into HTTP query parameters to add arbitrary configuration values to the config.ini file. This can lead to security setting tampering or modification of application behavior.

Affected Users: Users running ComfyUI-Manager in environments where ComfyUI is configured with the --listen option to allow remote access.

CVSS Score: 7.5 (High)

Patches

Fixed in the following versions: - 3.39.2 (v3.x branch) - 4.0.5 (v4.x branch)

Sanitization logic was added to the writeconfig() function to remove CRLF and NULL characters from all string values.

Workarounds

If upgrading is not possible: - Run ComfyUI-Manager only on trusted networks - Block external access via firewall - Run on localhost only without the --listen option

References

- CWE-93: Improper Neutralization of CRLF Sequences - OWASP CRLF Injection

Credit

This vulnerability was reported by: - 李存义 <xiaoheihei1107@gmail.com> - D0n9 Li <wyd0n9@gmail.com> - Swings <swing@mail.exp.sh> - Osword from SGLAB of Legendsec at Qi'anxin Group <zhzhdoai@gmail.com>

A CSRF vulnerability exists in comfyanonymous/comfyui versions up to v0.2.2. This vulnerability allows attackers to host malicious websites that, when visited by authenticated ComfyUI users, can perform arbitrary API requests on behalf of the user. This can be exploited to perform actions such as uploading arbitrary files via the /upload/image endpoint. The lack of CSRF protections on API endpoints like /upload/image, /prompt, and /history leaves users vulnerable to unauthorized actions, which could be combined with other vulnerabilities such as stored-XSS to further compromise user sessions.

A stored cross-site scripting (XSS) vulnerability exists in comfyanonymous/comfyui version 0.2.2 and possibly earlier. The vulnerability occurs when an attacker uploads an HTML file containing a malicious XSS payload via the /api/upload/image endpoint. The payload is executed when the file is viewed through the /view API endpoint, leading to potential execution of arbitrary JavaScript code.