CVE-2026-84702 facefusion CVE debrief

Who should care

Defenders responsible for facefusion deployments should assess exposure and prioritize patching or mitigations to prevent potential file writes. Defenders should prioritize verifying the affected versions, assessing exposure, and applying patches or mitigations to prevent potential file writes. This vulnerability has significant implications for operators, platforms, vulnerability-management teams, and security teams. Defenders should review compensating

Why it matters

CVE-2026-84702 is a high-severity vulnerability in facefusion that allows attackers to write files outside the jobs directory, potentially leading to security breaches.

• Verify affected versions and assess exposure
• Prevent potential file writes through patching or mitigations
• Monitor for suspicious activity on the HTTP API

Technical summary

The facefusion software fails to normalize job identifiers in the get_job_file_name function, allowing attackers to write files outside the jobs directory by supplying traversal sequences in the job identifier parameter through the unauthenticated HTTP API. This vulnerability has significant implications for defenders, who must assess exposure and prioritize patching or mitigations to prevent potential file writes. The vulnerability allows attackers to create files at arbitrary locations. Defenders should prioritize verifying the affected versions, assessing exposure, and applying patches or mitigations

Defensive priority

Defenders should prioritize verifying the affected versions, assessing exposure, and applying patches or mitigations to prevent potential file writes.

Recommended defensive actions

• Verify the version of facefusion and assess exposure
• Apply patches or mitigations to prevent potential file writes
• Monitor for suspicious activity on the HTTP API
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by a lack of normalization in the get_job_file_name function, allowing attackers to supply traversal sequences in the job identifier parameter. The facefusion software fails to normalize job identifiers in the get_job_file_name function, allowing attackers to write files outside the jobs directory. Evidence is limited to public CVE details and NVD assessments. Defenders should verify affected versions, assess exposure, and apply patches or mitigations to prevent potential file writes. The CVE record was

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.