ComfyUI workflow media loaders permit file probing and image disclosure outside the input directory
ComfyUI before 0.28.0 did not adequately contain annotated file paths used by LoadImage and related built-in media-loading nodes. An unauthenticated network caller able to submit a crafted workflow to the prompt API could probe files outside the configured input directory and retrieve files that ComfyUI could decode as images through its normal output and view paths.
Prerequisites
- A ComfyUI release before 0.28.0 exposes the prompt API to an untrusted network caller
- The ComfyUI process can access image-decodable files outside its configured input directory
Potential impact
- File-existence probing for paths readable by the ComfyUI process
- Disclosure of image-decodable files outside the configured input directory
Mitigations
- Upgrade ComfyUI to version 0.28.0 or later
- Do not expose the ComfyUI prompt API to untrusted networks
- Reject workflows from untrusted sources until the upgrade is complete
- Run ComfyUI with least filesystem privilege and isolate its input, output, model, and credential directories
Public sources
Research note
The vendor advisory also identifies LoadImageMask, LoadImageOutput, LoadAudio, LoadLatent, LoadVideo, and Load3D as affected annotated-file path consumers. Disclosure is limited to files accepted by the relevant media processing path; this record does not describe arbitrary text-file read. Not listed in the CISA Known Exploited Vulnerabilities catalog when verified on 2026-07-29.