HIGH

CVE-2026-92816

2026-09-16 CVSS v3.1

CVSS

7.8

Description

ComfyUI before 0.30.0 fails to sanitize folder_name input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through modified startup files or package initializers.

Weakness (CWE)

CWE-22 Path Traversal

EPSS Score

0.16%

Probability of exploitation in next 30 days

5.1th percentile

References

https://github.com/Comfy-Org/ComfyUI https://github.com/Comfy-Org/ComfyUI/blob/v0.24.0/comfy_extras/nodes_dataset.py#L303-L318 https://github.com/Comfy-Org/ComfyUI/blob/v0.30.0/comfy_extras/nodes_dataset.py https://github.com/geo-chen/oss/blob/main/ComfyUI.md https://www.vulncheck.com/advisories/comfyui-before-0.30.0-path-traversal-via-dataset-save-nodes

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE