Summary
A path traversal flaw in ComfyUI's get_model_preview API allows an unauthenticated attacker to escape the intended model directory and read image-decodable files from arbitrary paths on the host.
By abusing unrestricted route parameters, traversal sequences, and absolute paths, an attacker can disclose sensitive image content and use file existence as an oracle to enumerate host paths.
Affected context
The vulnerability exists in ComfyUI deployments that expose the HTTP API for model previews and rely on get_model_preview in app/model_manager.py to serve images from model directories.
It primarily affects environments where the ComfyUI service can access sensitive file paths on the same host or container filesystem and where reverse proxies, authentication, or segmentation do not sufficiently restrict who can make preview requests.
Exploit preconditions
- Attack surface: Public or internal HTTP endpoint providing model preview functionality.
- Required access: Network access to the ComfyUI server; no authentication is required by the vulnerable handler.
- Trigger point: Supplying crafted path segments in the {filename:.*} route capture or manipulating the path_index parameter when requesting a model preview.
- Why exploitation is possible: The server concatenates a user-controlled filename with a base folder using os.path.join without a containment check, and accepts traversal patterns, encoded traversal, absolute paths, and unbounded path_index values, allowing resolution of paths outside the intended model directory.
Why this happens
The core issue is improper restriction of a pathname to a limited directory, mapping directly to CWE-22.
User-controlled input from a broad route capture ({filename:.*}) is joined with a trusted base directory using os.path.join, but there is no normalization and validation step to ensure the final path remains inside the configured model folder.
Because traversal sequences (../), percent-encoded equivalents, absolute paths, and unbounded indices are accepted, the application treats attacker-supplied paths as trusted and passes them to file access routines, creating a directory traversal condition.
Potential impact
- Disclosure of images or image-decodable files located outside the intended model directory.
- Exposure of screenshots, dataset samples, or other sensitive visual assets stored on the host.
- Use of the endpoint as a file-existence oracle to enumerate directory structures and internal paths.
- Leakage of internal filesystem layout or configuration hints that could facilitate further attacks.
General mitigation guidance
Effective mitigation centers around strict path normalization and confinement for any file access operation influenced by user input.
Recommended patterns include:
- Normalizing requested paths and verifying that the resolved absolute path remains within an approved base directory before reading any file.
- Rejecting or canonicalizing traversal sequences and disallowing absolute paths or path segments that break out of the configured model folder.
- Replacing broad route captures with constrained patterns and validating filenames against expected formats or whitelists.
- Bounding and validating any index-based parameters (such as path_index) and decoupling them from direct filesystem paths.
- Running the service with least-privilege filesystem permissions so that even if traversal occurs, access to sensitive host areas is minimized.
How teams detect issues like this
Detection can rely on both code-centric and runtime approaches:
- Static analysis: Flag uses of os.path.join (or similar APIs) where one operand is user-controlled and no subsequent containment or canonicalization check is performed.
- Code review: Look for route patterns like {filename:.*} or other highly permissive parameters feeding directly into file system calls, especially where ../ or encoded traversal is not explicitly rejected.
- Policy enforcement: Establish guidelines that all file-serving endpoints must enforce base directory confinement and must not accept raw user paths.
- Runtime monitoring: Inspect access logs for atypical preview requests containing ../, %2e%2e%2f, or absolute path markers, as well as repeated probing patterns consistent with directory enumeration.
