Skip to content

CVE record · 2 sources

CVE-2026-123790

ComfyUI-Easy-Use version 1.3.6 contains a path traversal vulnerability in the `save_preview()` handler for POST `/easyuse/save/{name}`.

Vendor: ComfyUI-Easy-Use
Product: ComfyUI-Easy-Use
Exposure class: AI infrastructure

Coverage

2

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

40

CERT/CC note CERT/CC 5h ago

ComfyUI-Easy-Use contains unauthenticated path traversal vulnerability

Overview ComfyUI-Easy-Use version 1.4.1 and earlier contains a vulnerability in its save_preview() handler that allows an unauthenticated attacker to overwrite an installed custom node’s Python file. An attacker who can reach the…

Fix available CVE-2026-123790
26

CVE NVD 5h ago

ComfyUI-Easy-Use version 1.3.6 contains a path traversal vulnerability in the `save_preview()` handler for POST `/easyuse/save/{name}`.

ComfyUI-Easy-Use version 1.3.6 contains a path traversal vulnerability in the `save_preview()` handler for POST `/easyuse/save/{name}`. The handler checks the source directory before appending a user-supplied filename and allows…

CVE-2026-123790 ComfyUI-Easy-Use