CVE-2026-123790 Unauthenticated Path Traversal in ComfyUI-Easy-Use Allows Remote Code Execution
Unauthenticated attackers can overwrite a custom node's Python entry point via path traversal and run code on ComfyUI servers using Easy-Use.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Harmful if only installed
- No
- Needs a specific call
- No
- Fix
- None listed
What is CVE-2026-123790?
CVE-2026-123790 is a path traversal vulnerability in ComfyUI-Easy-Use, published on 12 Nov 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ComfyUI-Easy-Use version 1.3.6 contains a path traversal vulnerability in the `save_preview()` handler for POST `/easyuse/save/{name}`. The handler checks the source directory before appending a user-supplied filename and allows the request to select the `custom_nodes` directory as a copy destination. An unauthenticated attacker who can reach the ComfyUI server can overwrite an installed custom node’s Python entry point with an uploaded file. When ComfyUI restarts and loads the modified node, the attacker’s code runs with the privileges of the ComfyUI process.
Which versions are affected by CVE-2026-123790?
An affected version is exposed as installed. No special setting or call is needed.
How do I fix CVE-2026-123790?
No fix has been published for CVE-2026-123790 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-123790 being exploited?
There is no known exploitation of CVE-2026-123790 in the wild and no public exploit code.
Sources
Also known as GHSA-25xv-w465-qr9f.