CVE-2026-92816 Comfy-Org CVE debrief

Who should care

Defenders responsible for ComfyUI deployments, security teams, and developers using ComfyUI should assess exposure and prioritize remediation. This includes verifying affected systems, reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and planning vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

CVE-2026-92816 is a high-severity vulnerability in ComfyUI that allows attackers to write files to arbitrary paths, enabling code execution. Defenders should assess exposure, prioritize remediation, and verify affected systems.

• Code execution through modified startup files or package initializers
• Arbitrary file writes outside the output directory
• Potential for lateral movement and further exploitation

Technical summary

ComfyUI before version 0.30.0 fails to sanitize folder_name input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. This can be exploited by loading a crafted workflow that writes attacker-controlled content to arbitrary locations, potentially enabling code execution through modified startup files or package initializers. The vulnerability can be addressed by upgrading to version 0.30.0 or later and implementing compensating controls to restrict write access to sensitive directories.

Defensive priority

Defenders should prioritize verifying affected ComfyUI deployments, upgrading to version 0.30.0 or later, and implementing compensating controls to restrict write access to sensitive directories.

Recommended defensive actions

• Verify ComfyUI deployments for version 0.30.0 or later
• Restrict write access to sensitive directories
• Monitor for suspicious workflow uploads and file writes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but its actual impact and affected scope require verification from official sources. ComfyUI version 0.30.0 fixes the issue, but additional verification is needed to confirm if earlier versions are affected.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.