HIGH🇵🇱 Wersja polska

CVE-2025-67303

CVSS 7.5v3.1pub. 2026-01-05upd. 2026-01-30

An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data. This was due to the application storing its files in an insufficiently protected location that was accessible via the web interface

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

  • Comfy Comfyui Manager

    APP
    Comfy
    < 3.38
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-22777HIGH7.5same product

ComfyUI-Manager is an extension designed to enhance the usability of ComfyUI. Prior to versions 3.39.2 and 4.0...

CVE-2024-12882HIGH7.5same vendor

comfyanonymous/comfyui version v0.2.4 suffers from a non-blind Server-Side Request Forgery (SSRF) vulnerabilit...

CVE-2024-10481MEDIUM6.5same vendor

A CSRF vulnerability exists in comfyanonymous/comfyui versions up to v0.2.2. This vulnerability allows attacke...

CVE-2024-10099MEDIUM6.1same vendor

A stored cross-site scripting (XSS) vulnerability exists in comfyanonymous/comfyui version 0.2.2 and possibly ...