CVE-2026-123790: ComfyUI‑Easy‑Use path traversal allows code execution

# CVE-2026-123790: ComfyUI‑Easy‑Use path traversal allows code execution

https://gcdradar.vercel.app/incidents/cve-2026-123790-comfyui-easy-use-path-traversal-allows-code · AIR-2026-1931 · closed 2026-11-12

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability): Disclosed vulnerability without confirmed exploitation
- Fix status: Fix status unknown
- First reported: 2026-11-12
- AI role: Attack on AI
- Products: ComfyUI-Easy-Use
- CVE ids: CVE-2026-123790

## Summary

A path traversal flaw in ComfyUI‑Easy‑Use 1.3.6 allows an unauthenticated attacker to overwrite Python entry points of custom nodes, leading to code execution when the server restarts. The vulnerability is disclosed as CVE‑2026‑123790 but no exploitation has been reported.

## What to do

Update to a patched version when released and restrict unauthenticated access to the ComfyUI server

## Affected and fixed versions

- Affected: ComfyUI-Easy-Use 1.3.6

## Latest updates

- 2026-11-12: CVE-2026-123790: ComfyUI-Easy-Use version 1.3.6 contains a path traversal vulnerability in the `save_preview()` handler for POST… (https://nvd.nist.gov/vuln/detail/CVE-2026-123790)

## Sources

- 2026-11-12 NVD: CVE-2026-123790: ComfyUI-Easy-Use version 1.3.6 contains a path traversal vulnerability in the `save_preview()` handler for POST… https://nvd.nist.gov/vuln/detail/CVE-2026-123790

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.