CVE-2024-21575: Path traversal vulnerability in ComfyUI-Impact-Pack
ComfyUI-Impact-Pack
ComfyUI-Impact-Pack contains a path traversal vulnerability due to missing validation in the image upload endpoint. This flaw can permit arbitrary file writes and potential remote code execution.
disclosed CVENo confirmed exploitation, so this record is tracked as a disclosed vulnerability and not counted as an incident. It moves into the counts if CISA or the vendor confirms exploitation. Why
- CVSS
- 9.2
- EPSS
- 0.01 · top 37% · 2026-11-13
- fix status
- Fix status unknown
- first report
- 12 Dec 2024
- last update
- 12 Dec 2024
- CVE ids
Timeline · 1
Sources · 1
Advisories and databases
- 2024-12-12CVE-2024-21575: ComfyUI-Impact-Pack is vulnerable to Path Traversal.NVD · nvd.nist.gov/vuln/detail/CVE-2024-21575
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- lane
- Patch now
- AI role
- Attack on AI
- categories
- Infrastructure vulnerability
- severity
- 2 · Disclosed vulnerability
- fix status
- Fix status unknown
- targets
- Framework / tooling
- owasp llm top 10
- LLM03:2025 Supply Chain
- mitre atlas
- no technique for these categories
- dates
- happened 12 Dec 2024 · first reported 12 Dec 2024
- origin
- NVDVulnerability record from NVD / the GitHub Advisory Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- record
- confidence 0.95 · created 2026-10-18 10:04Z · updated 2026-10-18 10:04Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# CVE-2024-21575: Path traversal vulnerability in ComfyUI-Impact-Pack https://gcdradar.vercel.app/incidents/cve-2024-21575-path-traversal-vulnerability-in-comfyui-impac · AIR-2024-0268 · closed 2024-12-12 - Lane: Patch now - Severity: 2 (Disclosed vulnerability) - Fix status: Fix status unknown - First reported: 2024-12-12 - AI role: Attack on AI - Products: ComfyUI-Impact-Pack - CVE ids: CVE-2024-21575 - CVSS: 9.2 ## Summary ComfyUI-Impact-Pack contains a path traversal vulnerability due to missing validation in the image upload endpoint. This flaw can permit arbitrary file writes and potential remote code execution. ## What to do No action recorded; read the sources below and the vendor's advisory. ## Latest updates - 2024-12-12: CVE-2024-21575: ComfyUI-Impact-Pack is vulnerable to Path Traversal. (https://nvd.nist.gov/vuln/detail/CVE-2024-21575) ## Sources - 2024-12-12 NVD: CVE-2024-21575: ComfyUI-Impact-Pack is vulnerable to Path Traversal. https://nvd.nist.gov/vuln/detail/CVE-2024-21575 Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- closed6.9LangChain4j-AIDeepin CVE-2025-21604: File upload conflict vulnerability in LangChain4j-AIDeepin
Patch now · Disclosed · since 6 Jan 2025 · CVE-2025-21604
AI - closed10.0ComfyUI + custom nodes CVE-2024-21577: Code injection vulnerability in ComfyUI-Ace-Nodes
Patch now · Disclosed · since 13 Dec 2024 · CVE-2024-21577
AI - closed10.0ComfyUI + custom nodes CVE-2024-21576: Code injection vulnerability in ComfyUI-Bmad-Nodes
Patch now · Disclosed · since 13 Dec 2024 · CVE-2024-21576
AI - closed8.1Lobe Chat CVE-2024-32965: LobeChat server side request forgery vulnerability
Patch now · Disclosed · since 26 Nov 2024 · CVE-2024-32965
AI - closed8.8Hugging Face libraries CVE-2024-11394: Deserialization vulnerability in Hugging Face Transformers
Patch now · Disclosed · since 23 Nov 2024 · updated 23 Nov 2024 · CVE-2024-11394
AI - closed8.8Hugging Face libraries CVE-2024-11393: Deserialization vulnerability in Hugging Face Transformers
Patch now · Disclosed · since 23 Nov 2024 · updated 23 Nov 2024 · CVE-2024-11393
AI