ComfyUI before version 0.30.0 fails to properly sanitize the folder_name parameter in dataset save nodes. An attacker can exploit this by loading a crafted workflow that writes attacker-controlled content to arbitrary file system locations outside the designated output directory. This improper limitation of pathname enables path traversal, which can be leveraged to execute arbitrary code through modified startup scripts or package initialization files.

Successful exploitation allows an attacker with local access and user interaction to write files to arbitrary locations on the file system, potentially leading to arbitrary code execution. This can compromise the integrity and security of the affected system by enabling execution of malicious code during application startup or package initialization.

A fix is available in ComfyUI version 0.30.0 and later. Users should upgrade to version 0.30.0 or newer to remediate this vulnerability. Until then, avoid loading untrusted workflows that could exploit this path traversal issue.