The vulnerability resides in the copyFileSync function within src/tools/utils.ts of the comfy_upload_image component. A crafted image_path argument containing traversal sequences can cause the function to access and read files outside the intended upload directory. This local exploitation can compromise the confidentiality and integrity of sensitive files stored on the host.

Nikolaibibo:claude-comfyui-mcp version 1.0.0 is affected. The flaw is triggered when copyFileSync is called with an unrestricted image_path argument in the upload component. The vulnerability is local; an attacker must have ability to run code on the host or use a privileged user role that can interact with the application.

The CVSS base score of 4.8 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation. Because the attack vector is local, the threat is limited to systems where an adversary can gain code execution privileges, and no public fix has been released. Organizations should monitor the vendor for a fix and employ mitigations until one becomes available.