PT-2026-33660
CVE-2026-6591
·
Published
2026-04-20
·
Updated
2026-04-20
Description by
CVSS 3.1
4.3
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions
ComfyUI versions prior to 0.13.0
Description
A path traversal flaw exists in the LoadImage Node component within the
folder paths.get annotated filepath() function of the folder paths.py file. This issue occurs due to improper manipulation of the Name argument, allowing for remote exploitation.Recommendations
Update to a version later than 0.13.0.
As a temporary workaround, restrict access to the
folder paths.get annotated filepath() function until the update is applied.Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾