PatchSiren cyber security CVE debrief
CVE-2026-77815 zanllp CVE debrief
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-21T15:16:47.883Z and has not been modified since then. The CVE-2026-77815 vulnerability in Stable Diffusion WebUI arises from improper path normalization using os.path.normpath, which allows symbolic links within scanned directories to point outside those directories. This can lead to unauthorized file disclosure when access control is enabled in network-exposed WebUI deployments. The vulnerability is mitigated by a patch that uses os.path.realpath for path resolution. Administrators and users of Stable Diffusion WebUI, especially those with network-exposed deployments, should be aware of this vulnerability and take steps to verify and enforce proper access control configurations. The containment check in is_path_trusted in scripts/iib/api.py does not prevent this because it relies on the flawed normalization. The vulnerability's impact depends on the get_enable_access_control function in scripts/iib/tool.py, which determines whether access control is enabled based on the IIB_ACCESS_CONTROL environment variable or specific host startup options.
- Vendor
- zanllp
- Product
- infinite-image-browsing
- CVSS
- HIGH 8.7
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-21
- Original CVE updated
- 2026-08-21
- Advisory published
- 2026-08-21
- Advisory updated
- 2026-08-21
Who should care
Administrators and users of Stable Diffusion WebUI, especially those with network-exposed deployments, should be aware of this vulnerability and take steps to verify and enforce proper access control configurations.
Technical summary
The CVE-2026-77815 vulnerability in Stable Diffusion WebUI arises from improper path normalization using os.path.normpath, which allows symbolic links within scanned directories to point outside those directories. This can lead to unauthorized file disclosure when access control is enabled in network-exposed WebUI deployments. The vulnerability is mitigated by a patch that uses os.path.realpath for path resolution.
Defensive priority
This vulnerability allows unauthorized file disclosure in network-exposed WebUI deployments of Stable Diffusion WebUI when access control is enabled. Administrators should verify their deployment configurations and ensure that access control is properly set up.
Recommended defensive actions
- Verify and enforce proper access control configurations for Stable Diffusion WebUI deployments.
- Restrict access to sensitive directories and files.
- Monitor for suspicious symlink creation within scanned directories.
- Apply the patch that resolves paths with os.path.realpath.
- Review and adjust IIB_ACCESS_CONTROL environment variable settings.
Evidence notes
The CVE-2026-77815 vulnerability arises from the use of os.path.normpath in to_abs_path within scripts/iib/tool.py, which does not resolve symbolic links. This allows a symlink within a scanned directory to point outside that directory, potentially disclosing files like /etc/passwd when a link is created in an image directory. The containment check in is_path_trusted in scripts/iib/api.py does not prevent this because it relies on the flawed normalization. The vulnerability's impact depends on the get_enable_access_control function in scripts/iib/tool.py, which determines whether access control is enabled based on the IIB_ACCESS_CONTROL environment variable or specific host startup options. The fix involves resolving the path with os.path.realpath.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-21T15:16:47.883Z and has not been modified since then.