{"id":"CVE-2026-92816","title":"ComfyUI before 0.30.0 fails to sanitize folder_name input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory","summary":"ComfyUI before 0.30.0 fails to sanitize folder_name input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled con…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-22"],"vendor":"Comfy-Org","product":"ComfyUI","affected":["ComfyUI < 0.30.0"],"published":"2026-09-16","updated":"2026-09-22","sourceUpdated":"2026-09-22T20:53:07.383","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92816","references":[{"url":"https://github.com/Comfy-Org/ComfyUI","label":"disclosure@vulncheck.com"},{"url":"https://github.com/Comfy-Org/ComfyUI/blob/v0.24.0/comfy_extras/nodes_dataset.py#L303-L318","label":"disclosure@vulncheck.com"},{"url":"https://github.com/Comfy-Org/ComfyUI/blob/v0.30.0/comfy_extras/nodes_dataset.py","label":"disclosure@vulncheck.com"},{"url":"https://github.com/geo-chen/oss/blob/main/ComfyUI.md","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/comfyui-before-0.30.0-path-traversal-via-dataset-save-nodes","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00156,"epssPercentile":0.05131,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-09-21T15:52:12.481772Z"},"ingestedAt":"2026-09-16T21:05:36.879Z","slug":"CVE-2026-92816","body":"## Overview\n\nComfyUI before 0.30.0 fails to sanitize folder_name input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through modified startup files or package initializers.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":208529,"id":"CVE-2026-92816","ts":1790007740368,"field":"exploit_available","old":"false","new":"true"}]}