CVE-2024-21575

Summary

CVE-2024-21575 is a newly disclosed vulnerability affecting the ComfyUI-Impact-Pack. The issue arises due to a lack of validation for the `image.filename` field in POST requests sent to the `/upload/temp` endpoint. This vulnerability enables an attacker to conduct path traversal attacks, potentially leading to arbitrary file writing on the server. In certain circumstances, this could result in remote code execution (RCE), posing a significant security risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.