This vulnerability exists in ComfyUI's folder_paths.py file, specifically in the get_annotated_filepath function used by the LoadImage Node. By manipulating the 'Name' argument, an attacker can perform path traversal, potentially accessing files outside intended directories. The vulnerability can be exploited remotely without user interaction and requires low attack complexity and limited privileges. The CVSS 4.0 base score is 5.3, reflecting medium severity. No vendor advisory or patch has been published, and the vendor did not respond to early contact attempts.

Successful exploitation could allow an attacker to read arbitrary files on the system where ComfyUI is running, potentially exposing sensitive information. The vulnerability does not require user interaction and can be triggered remotely with low complexity. However, it requires limited privileges, and there is no indication of privilege escalation or code execution. No confirmed exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider restricting access to the affected component and monitor for suspicious activity. Avoid exposing ComfyUI instances to untrusted networks until a fix is released.