Description
An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data. This was due to the application storing its files in an insufficiently protected location that was accessible via the web interface
Affected products
comfy: comfyui-manager
References2
- github.com/Comfy-Org/ComfyUI-Manager/pull/2338/commits/e44c5cef… Patch
- github.com/Comfy-Org/ComfyUI-Manager/blob/main/docs/en/v3.38-us… ExploitThird Party Advisory
Metrics
- CVSS 3.1
-
7.5
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - EPSS — exploit probability
- 1% percentile: 73 · as of 11 November 2026
- CWE
- CWE-420
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.