CVE-2025-67303

HIGH7.5

An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data

Published Jan 5, 2026

Modified 8 months ago

Details

An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data. This was due to the application storing its files in an insufficiently protected location that was accessible via the web interface

References

WEB

https://github.com/Comfy-Org/ComfyUI-Manager/blob/main/docs/en/v3.38-userdata-security-migration.md

WEB

https://github.com/Comfy-Org/ComfyUI-Manager/pull/2338/commits/e44c5cef58fb4973670b86433b9d24d077b44a26

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2025-67303

CVSS Analysis

CVSS v3.1

7.5

Exploitability

Attack Vector