ComfyUI-Impact-Pack is vulnerable to Path Traversal. The issue stems from missing validation of the `image.filename` field in a POST request sent to the `/upload/temp` endpoint added by the extension to the server. This results in writing arbitrary files to the file system which may, under some conditions, result in remote code execution (RCE).
The vulnerability results from lack of validation of the `image.filename` field in the POST request sent to the `/upload/temp` endpoint, added by the extension to the ComfyUI server. An attacker can construct a malicious filename containing path traversal sequences (e.g., `../../`), resulting in the file being written outside the intended target directory. By placing an appropriately crafted file in a critical location of the file system, it is possible to achieve RCE.
An attacker can write arbitrary files to any location accessible to the server process, which under certain conditions may lead to remote code execution (RCE) on the victim's server.
ComfyUI-Impact-Pack should be updated to a version containing the patch introduced in commit a43dae373e648ae0f0cc0c9768c3cea6a72acff7 available in the project's GitHub repository. Additionally, it is recommended to restrict network access to ComfyUI server endpoints exclusively to trusted hosts.
ComfyUI-Impact-Pack — versions before commit a43dae373e648ae0f0cc0c9768c3cea6a72acff7 (specific versions indicated in manufacturer references)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X