Path Traversal in ComfyUI Model Preview Functionality

ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, get_model_preview in app/model_manager.py joins an unrestricted filename route capture to a selected model directory without a containment check, allowing an unauthenticated remote attacker to use traversal, encoded traversal, absolute paths, or an unbounded path_index to read image-decodable files and enumerate host paths. get_model_preview (app/model_manager.py) built the path with os.path.join(folder, filename) where filename is an unrestricted {filename:.*} route capture. Literal ../, percent-encoded %2e%2e%2f, and absolute paths all escaped the model directory; path_index was also unbounded. The target file is piped through Pillow and re-encoded as WEBP, so disclosure is limited to image-decodable files plus a file-existence/enumeration oracle (and internal-path leakage via path_index errors). This issue is fixed in version 0.28.0.

Casky was already ahead

This CVE exploits attack patterns that Casky's 351matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

ComfyUI versions prior to 0.28.0 contain a critical path traversal vulnerability in the get_model_preview function that allows unauthenticated remote attackers to read arbitrary files from the host system. By manipulating filename parameters with traversal sequences, encoded payloads, absolute paths, or unbounded indices, attackers can bypass directory containment checks and enumerate sensitive files and directory structures. This vulnerability affects any organization running vulnerable ComfyUI instances, particularly those exposing the API to untrusted networks, as the flaw requires no authentication and can be exploited to extract image files and map the host filesystem.

Casky's 351 mapped skills detect the attack patterns underlying this vulnerability by correlating reconnaissance and lateral movement techniques (TA0001 and TA0007) with Claude's extended reasoning capabilities. Practitioners using Casky would identify suspicious patterns including: abnormal path parameter values containing "../" sequences or URL-encoded traversal characters, repeated requests with incrementing path_index values suggesting enumeration attempts, file access logs showing reads outside expected model directories, and sudden access to system-level paths or sensitive configuration locations. The platform's skill mapping enables detection of the initial reconnaissance phase as attackers probe directory structures, followed by exploitation attempts using various encoding bypass techniques—each correlated to specific MITRE techniques for precise threat categorization and response guidance.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

351 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-56671.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2026-56671

Casky has 351 skills that investigate the attack patterns behind CVE-2026-56671. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn