CVE-2024-21575

Severity: high (CVSS 8.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-12 · updated 2026-06-17
Weakness: CWE-35

Description

ComfyUI-Impact-Pack is vulnerable to Path Traversal. The issue stems from missing validation of the `image.filename` field in a POST request sent to the `/upload/temp` endpoint added by the extension to the server. This results in writing arbitrary files to the file system which may, under some conditions, result in remote code execution (RCE).

Affected products

ltdrdata ComfyUI-Impact-Pack: before 7.6.2 — fixed in 7.6.2

How to fix

Upgrade to a fixed version: ltdrdata ComfyUI-Impact-Pack 7.6.2. Check the vendor advisory for mitigations.

References

https://github.com/ltdrdata/ComfyUI-Impact-Pack/blob/1087f2ee063c9d53cd198add79b41a7a3465c05a/modules/impact/impact_server.py#L28
https://github.com/ltdrdata/ComfyUI-Impact-Pack/commit/a43dae373e648ae0f0cc0c9768c3cea6a72acff7

Get alerted when CVE-2024-21575 or the next vulnerability affects your stack