ComfyUI's CVE-2026-56673: A 7.5 path traversal in the AI art stack

ComfyUI, the modular diffusion model GUI and backend, shipped a path traversal vulnerability that lets an unauthenticated attacker read arbitrary image-format files off the host machine. The flaw, tracked as CVE-2026-56673 and rated 7.5 HIGH under CVSS 3.1, was published to the NVD on July 31, 2026, with GitHub, Inc. as the CNA. It affects every version before 0.28.0 and is fixed in that release.

The mechanics are worth sitting with, because they are not exotic. ComfyUI’s folder_paths.get_annotated_filepath and exists_annotated_filepath join workflow-controlled annotated filenames to a base directory without a containment check. An unauthenticated crafted POST to /prompt using a LoadImage node, or any of its siblings, can probe arbitrary host paths and exfiltrate image-format files through /view. The vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N: network, low complexity, no privileges, no user interaction, high confidentiality impact. CISA’s SSVC assessment, added the same day, flags it as automatable with partial technical impact.

The detail that should bother anyone running ComfyUI in production is the root cause. LoadImage defines a VALIDATE_INPUTS method, and that method causes the execution engine to skip COMBO validation, the check that normally confines inputs to a designated input directory. The validation escape hatch, meant to give node authors flexibility, became the hole. Affected nodes include LoadImage, LoadImageMask, LoadImageOutput, LoadAudio, LoadLatent, LoadVideo, and Load3D.

This is a small bug in a widely used tool. But read it through the AI lens and it is a pattern, not an incident.

The trust model of AI workflows is broken

ComfyUI is not a niche toy. It is the de facto standard interface for running Stable Diffusion and other diffusion models locally and on rented GPU boxes. Its graph-and-node interface is how a large slice of the AI art community, and a growing number of commercial pipelines, compose models, LoRAs, and control nets. The project’s GitHub is a busy place; the fix pull request and the 0.28.0 release notes are the canonical references, alongside the security advisory GHSA-rvxv-29p8-pxgq.

The deeper problem: ComfyUI workflows are executable content. A workflow is a JSON graph that the engine runs, and running it means trusting node code with host resources. The platform treats workflows as data, but they are closer to scripts. When a workflow can reach outside its sandbox and read arbitrary files, the line between “sharing a nice prompt graph” and “handing someone a read primitive into your machine” disappears.

That is the uncomfortable truth this CVE surfaces. The AI ecosystem has built an enormous amount of tooling where untrusted content flows into privileged execution contexts. ComfyUI is one instance. The same shape appears in model loading pipelines, agent frameworks that execute tool calls, and MCP servers that hand filesystem access to language models. Every one of those layers makes the same implicit bet: the content is benign, the sandbox holds.

Why the CVSS score undersells it

A 7.5 for a read-only file disclosure sounds moderate. The vector says high confidentiality impact with no integrity or availability impact. But the real-world context changes the arithmetic. ComfyUI instances are frequently deployed on shared GPU servers, often with a public or semi-public web UI exposed so that friends, clients, or collaborators can queue jobs. The unauthenticated requirement means no login wall protects the endpoint. The automatable flag from CISA means it can be scripted at scale.

What can an attacker read? Image-format files. That includes PNG, JPG, and other formats the /view endpoint will serve. On a typical ComfyUI host, that includes the user’s generated outputs, but also anything else in image format that the process can reach: screenshots, scanned documents, exported graphics, potentially keys or credentials saved as images. The scope is not limited to the ComfyUI data directory, because the containment check is missing entirely. The annotated filename is joined to a base directory, and without a check, ../ sequences walk up the tree.

The fix is straightforward: add a containment check so the resolved path stays inside the intended base directory. That is textbook CWE-22, Improper Limitation of a Pathname to a Restricted Directory. The advisory lists it as such. The patch in PR 14734 presumably does exactly that. This is not a hard vulnerability class to prevent. It is the kind of bug that code review should catch, and that a security-focused test suite would flag.

The AI tooling security gap is structural

Here is the uncomfortable part for the industry. ComfyUI is open source, popular, and maintained by a real organization, Comfy-Org. It still shipped a basic path traversal in 2026. The AI tooling ecosystem, from inference servers to agent runtimes to workflow engines, is dominated by fast-moving open source projects where security review lags feature velocity. The incentives push toward shipping the next node, the next model loader, the next agent capability. Containment checks are unglamorous.

There is also a cultural dimension. The AI community historically treats its tools as research software, not production infrastructure. ComfyUI began as a research and hobbyist tool. The assumption that it would stay behind a trusted user’s firewall persisted even as deployment patterns changed. The same assumption now applies to a generation of agent frameworks and MLOps platforms that are being wired into production systems with alarming speed.

The CVE is a reminder that AI infrastructure inherits every classic software vulnerability class, and adds new ones on top. Path traversal is older than the web. But the workflow-as-data model gives it a fresh attack surface: the attacker does not need to exploit a memory bug or a deserialization flaw. They just need to craft a JSON graph that the engine obediently executes.

What builders should take from this

For anyone running ComfyUI, the action is unambiguous: upgrade to 0.28.0 or later. If you expose the web UI beyond localhost, treat that as a security boundary, not a convenience. Put it behind authentication, a reverse proxy, or a VPN. The advisory is public, and the exploitation requirements are minimal: network access, low complexity, no privileges.

For the broader AI tooling ecosystem, the lesson is that validation skips and trust boundaries need to be treated as first-class design constraints. The VALIDATE_INPUTS method that disabled COMBO validation is a perfect example of a convenience feature with a hidden security cost. Every such escape hatch should be audited as a potential boundary violation.

The industry is moving toward agents that can read files, run commands, and call tools. ComfyUI’s bug is a preview of the class of failures that will keep recurring. Until AI platforms treat untrusted workflows, prompts, and tool definitions as executable content with the security review that implies, CVEs like this one will keep arriving. The patch is easy. The pattern is not.