PT-2025-12042 · Comfyanonymous · Comfyui

Published 2025-03-20 · Updated 2025-07-29 · CVE-2024-10481

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions comfyanonymous/comfyui versions up to v0.2.2

Description A CSRF issue exists, allowing attackers to host malicious websites that can perform arbitrary API requests on behalf of authenticated users when visited. This can be exploited to upload arbitrary files via the "/upload/image" endpoint. The lack of CSRF protections on API endpoints like "/upload/image", "/prompt", and "/history" leaves users vulnerable to unauthorized actions.

Recommendations For versions up to v0.2.2, as a temporary workaround, consider disabling access to the vulnerable API endpoints "/upload/image", "/prompt", and "/history" until a patch is available. Restrict access to these endpoints to minimize the risk of exploitation. Avoid using these endpoints in user sessions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-10481

Affected Products

Comfyui

References · 5

• 🔥 https://huntr.com/bounties/f4d5bfb5-6ff1-4356-b81f-f8c01d2e6ded · Exploit
• https://osv.dev/vulnerability/CVE-2024-10481 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10481 · Security Note
• https://t.me/cveNotify/130138 · Telegram Post
• https://twitter.com/CVEnew/status/1903336827089559673 · Twitter Post