CVE-2026-6590

MEDIUM

ComfyUI Model Preview Endpoint model_manager.py get_model_preview path traversal

Title source: cna
STIX 2.1

Description

A vulnerability was detected in ComfyUI up to 0.13.0. This impacts the function get_model_preview of the file app/model_manager.py of the component Model Preview Endpoint. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-358225 | ComfyUI Model Preview Endpoint model_manager.py get_model_preview path traversal
https://vuldb.com/vuln/358225
Signature, Permissions Required signature permissions-required
VDB-358225 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/358225/cti
Third Party Advisory third-party-advisory
Submit #791109 | comfyanonymous ComfyUI <= 0.13.0 (commit 6648ab68) Path Traversal (CWE-22)
https://vuldb.com/submit/791109

Scores

CVSS v3 4.3
EPSS 0.0037
EPSS Percentile 28.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (13)
None/ComfyUI 0.1
None/ComfyUI 0.10
None/ComfyUI 0.11
None/ComfyUI 0.12
None/ComfyUI 0.13.0
None/ComfyUI 0.2
None/ComfyUI 0.3
None/ComfyUI 0.4
None/ComfyUI 0.5
None/ComfyUI 0.6
... and 3 more
Published Apr 20, 2026
Tracked Since Apr 20, 2026