by Kastro
Paper/Archive/CVE-2024-21575

CVE-2024-21575

ltdrdata ComfyUI-Impact-Pack — ComfyUI-Impact-Pack is vulnerable to Path Traversal.

EPSS 1%CVSS 9.2
critical.is priorityof 100
40
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 62.8.628 × 2012.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

ComfyUI-Impact-Pack is vulnerable to Path Traversal. The issue stems from missing validation of the `image.filename` field in a POST request sent to the `/upload/temp` endpoint added by the extension to the server. This results in writing arbitrary files to the file system which may, under some conditions, result in remote code execution (RCE).

Affected

ProductAffectedFixed inSource
ComfyUI-Impact-Pack< 7.6.27.6.2CNA

Scores by source

snyk (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
snyk (CNA)8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/ltdrdata/ComfyUI-Impact-Pack/commit/a43dae373e648ae0f0cc0c9768c3cea6a72acff7refgithub.com/ltdrdata/ComfyUI-Impact-Pack/blob/1087f2ee063c9d53cd198add79b41a7a3465c05a/modules/impact/impact_server.py#L28