CVE-2025-67303

Published Jan 5, 2026

Last updated 25 days ago

ComfyUI-Manager

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-67303 describes a vulnerability found in ComfyUI-Manager, affecting versions prior to 3.38. This issue allows remote attackers to potentially manipulate the application's configuration and critical data. The root cause of this vulnerability is that ComfyUI-Manager stores its files in a location that is insufficiently protected and accessible via the web interface. The vulnerability was published on January 5, 2026.

Description: An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data. This was due to the application storing its files in an insufficiently protected location that was accessible via the web interface
Source: cve@mitre.org
NVD status: Analyzed
Products: comfyui-manager

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Severity: HIGH

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-420

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:comfy:comfyui-manager:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A2BEDC7B-32BB-4C47-81B5-4EC4357B3E36",
            "versionEndExcluding": "3.38"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.