ComfyUI-Impact-Pack is vulnerable to Path Traversal. The issue stems from...
Vulnerability Description
ComfyUI-Impact-Pack is vulnerable to Path Traversal. The issue stems from missing validation of the `image.filename` field in a POST request sent to the `/upload/temp` endpoint added by the extension to the server. This results in writing arbitrary files to the file system which may, under some conditions, result in remote code execution (RCE).
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-21575
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Raul Onitza-Klugman (Snyk Security Research)
References
Affected Vendor
ltdrdata
View all reports →