CVE-2026-77815

Name of the Vulnerable Software and Affected Versions Stable Diffusion WebUI (affected versions not specified)

Description The to abs path function in scripts/iib/tool.py uses os.path.normpath to normalize requested paths. This method collapses dot segments but fails to resolve symbolic links. Consequently, a symlink placed within a scanned directory can bypass the containment check performed by the is path trusted function in scripts/iib/api.py while pointing to a location outside that directory. When FileResponse serves the response, it follows the link, potentially disclosing sensitive files such as /etc/passwd. This issue affects network-exposed deployments where access control is enabled via IIB ACCESS CONTROL or when the host is started with share, ngrok, listen, or server name options.

Recommendations Update the software to a version where the to abs path function in scripts/iib/tool.py uses os.path.realpath to resolve paths.