ComfyUI-Easy-Use version 1.3.6 has a path traversal vulnerability in the save_preview() handler that allows an unauthenticated attacker to overwrite custom node Python entry points by uploading files to the custom_nodes directory. This can lead to arbitrary code execution with the privileges of the ComfyUI process upon restart.