facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outside the jobs directory. (CVE-2026-84702)

The vulnerability in facefusion up to version 3.6.1 is due to improper normalization of job identifiers in the get_job_file_name function. This flaw enables attackers to supply directory traversal sequences through an unauthenticated HTTP API, resulting in arbitrary file write capabilities outside the designated jobs directory. The issue is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

An unauthenticated attacker can write files to arbitrary locations on the affected system by exploiting the directory traversal flaw. This can lead to unauthorized file creation or modification, potentially impacting system integrity. The CVSS score is 7.5 (High), indicating significant risk due to the ease of exploitation (network attack vector, no privileges or user interaction required) and the impact on integrity.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the HTTP API if possible and monitor for suspicious activity related to file writes outside the jobs directory.