What happened
NVD published CVE-2026-56673 (CVSS 7.5, High) on 2026-07-31; GitHub Security Advisory GHSA-rvxv-29p8-pxgq confirms the LoadImage node's VALIDATE_INPUTS method bypasses COMBO input-directory validation, leaving only the vulnerable path-join logic as a guard.
Why it matters
ComfyUI is broadly deployed for AI image generation both locally and as a hosted service; an unauthenticated attacker can use a crafted workflow to read arbitrary host files (e.g., credentials, config files disguised or convertible to image format) without any authentication, directly compromising confidentiality of the hosting environment.
Attack vector
folder_paths.get_annotated_filepath and exists_annotated_filepath join workflow-controlled annotated filenames to a base directory without a containment check; an unauthenticated crafted POST /prompt workflow using LoadImage or sibling nodes (LoadImageMask, LoadAudio, LoadLatent, LoadVideo, Load3D) can probe arbitrary host paths as a file-existence oracle and exfiltrate any image-format file via the /view endpoint.
Affected systems
ComfyUI (Comfy-Org/ComfyUI) prior to 0.28.0
Mitigation
Upgrade to ComfyUI 0.28.0+, which adds realpath+commonpath containment checks to get_annotated_filepath and exists_annotated_filepath.