HIGH🇵🇱 Wersja polska

CVE-2025-67303

CVSS 7.5v3.1pub. 2026-01-05upd. 2026-01-30

An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data. This was due to the application storing its files in an insufficiently protected location that was accessible via the web interface

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

  • Comfy Comfyui Manager

    APP
    Comfy
    < 3.38
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-22777HIGH7.5ten sam produkt

ComfyUI-Manager is an extension designed to enhance the usability of ComfyUI. Prior to versions 3.39.2 and 4.0...

CVE-2024-12882HIGH7.5ten sam vendor

comfyanonymous/comfyui version v0.2.4 suffers from a non-blind Server-Side Request Forgery (SSRF) vulnerabilit...

CVE-2024-10481MEDIUM6.5ten sam vendor

A CSRF vulnerability exists in comfyanonymous/comfyui versions up to v0.2.2. This vulnerability allows attacke...

CVE-2024-10099MEDIUM6.1ten sam vendor

A stored cross-site scripting (XSS) vulnerability exists in comfyanonymous/comfyui version 0.2.2 and possibly ...