CVE-2026-123790
Unauthenticated Path Traversal in ComfyUI-Easy-Use Allows Remote Code Execution
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
ComfyUI-Easy-Use version 1.3.6 contains a path traversal vulnerability in the `save_preview()` handler for POST `/easyuse/save/{name}`. The handler checks the source directory before appending a user-supplied filename and allows the request to select the `custom_nodes` directory as a copy destination. An unauthenticated attacker who can reach the ComfyUI server can overwrite an installed custom node’s Python entry point with an uploaded file. When ComfyUI restarts and loads the modified node, the attacker’s code runs with the privileges of the ComfyUI process.
| Vendor | comfyui-easy-use |
| Product | comfyui-easy-use |
| Published | Nov 12, 2026 |
| Last Updated | Nov 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for comfyui-easy-use comfyui-easy-use
Be the first to know when new unknown vulnerabilities affecting comfyui-easy-use comfyui-easy-use are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
ComfyUI-Easy-Use / ComfyUI-Easy-Use
1.3.6 ≤ 1.4.1