Summary
A path traversal vulnerability in ComfyUI's media loading nodes allows workflow-controlled filenames to be joined to a base directory without verifying they stay within that directory.
An unauthenticated attacker can craft a POST /prompt workflow that probes arbitrary host paths and exfiltrates readable image-format files via the /view endpoint when certain loader nodes are used.
Affected context
The issue arises in ComfyUI deployments that expose the HTTP API and allow untrusted users to submit or modify workflows.
The vulnerable behavior appears when nodes such as LoadImage, LoadImageMask, LoadImageOutput, LoadAudio, LoadLatent, LoadVideo, and Load3D accept annotated filenames that are concatenated with a base directory without performing containment or canonicalization checks.
When the execution engine honors the nodes' VALIDATE_INPUTS behavior and skips directory validation, attacker-controlled paths can reference files outside the intended media folder structure, subject to OS-level read permissions.
Exploit preconditions
- Attack surface: HTTP API endpoints, specifically POST
/promptfor workflow submission and/viewfor viewing outputs. - Required access: Network reachability to the ComfyUI instance; no authentication required in default open deployments.
- Trigger point: Use of vulnerable loader nodes (e.g., LoadImage, LoadAudio, LoadVideo) in a crafted workflow with annotated filenames containing path traversal sequences or absolute paths.
- Why exploitation is possible: The functions
folder_paths.get_annotated_filepathandexists_annotated_filepathconcatenate workflow-controlled filenames with a base directory without checking that the resulting path remains inside the intended directory, and the VALIDATE_INPUTS logic can bypass COMBO input-directory validation.
Why this happens
At its core, this vulnerability stems from improper validation of file paths constructed using user-controlled input.
The application takes annotated filenames provided by the workflow, joins them with a base folder, and then uses the resulting path without normalizing or confirming that it resides within an approved directory.
This behavior maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, where path traversal sequences (such as relative directory components or absolute paths) allow access to files outside the intended root.
The additional use of a VALIDATE_INPUTS mechanism that disables directory validation for certain nodes further weakens the trust boundary between user workflows and the host filesystem.
Potential impact
- An attacker may read arbitrary image or media files on the host that are accessible to the ComfyUI process.
- An attacker could probe the filesystem to discover the presence or absence of specific paths, aiding reconnaissance.
- Sensitive information, such as configuration screenshots, cached images, or media-derived data, could be exfiltrated via the
/viewendpoint. - In environments where media-format files contain confidential or proprietary content, this could lead to broader information disclosure and privacy violations.
General mitigation guidance
Effective mitigation focuses on constraining how file paths are derived and enforced at the boundary between workflows and the filesystem.
Common patterns include:
- Performing canonicalization and containment checks on all user-influenced paths to ensure they resolve within a designated media directory.
- Using strict allowlists of directories and disallowing absolute paths or parent-directory components in annotated filenames.
- Enforcing validation logic consistently across all nodes so that no node can bypass directory checks through custom validation hooks.
- Running the ComfyUI process under an account with least-privilege filesystem permissions, isolating it from sensitive host directories.
- Segregating user-uploaded or workflow-referenced media into dedicated, sandboxed storage locations rather than sharing host-wide paths.
How teams detect issues like this
Organizations can identify similar weaknesses by:
- Applying static analysis or linters that flag manual path concatenation with user-controlled input (e.g., string-based joining of directory and filename).
- Reviewing code for any helper functions that build file paths and confirming they enforce canonicalization and directory whitelisting.
- Implementing security-focused code review checklists that highlight filesystem access, especially around media loaders and plug-in nodes.
- Using runtime logging and monitoring to track unusual file access patterns, such as repeated attempts to access parent directories or non-media paths via workflow submissions.
- Integrating automated security testing or fuzzing of API endpoints (like POST
/prompt) with path traversal payloads to ensure defenses are effective.
