ComfyUI’s get_model_preview endpoint constructs file paths by concatenating an unrestricted filename route capture with the selected model directory using os.path.join. Without a containment check, the endpoint allows traversal characters, URL‑encoded traversal, absolute paths, and even an unbounded path_index, enabling an unauthenticated remote attacker to read arbitrary image‑decodable files from the host filesystem. The disclosed data is limited to files that Pillow can process and to a file‑existence oracle, but enumeration of host paths is possible via error messages or path_index responses. This vulnerability maps directly to the file‑path traversal weakness, CWE‑22.

All publicly available releases of Comfy‑Org’s ComfyUI prior to version 0.28.0 are affected. Users of v0.27.x or older may be exposed to this path traversal flaw. The issue is resolved in the 0.28.0 release, which sanitizes the filename before path construction.

The CVSS base score of 7.5 signifies a high‑level severity for remote unauthenticated exploitation. The EPSS score is less than 1%, indicating a very low but non‑zero likelihood of exploitation. The lack of authentication requirements and the simplicity of the attack path—based on the description, the attack vector is inferred to be remote via an HTTP request to the /experiment/models/preview endpoint—make exploitation likely in practice. The vulnerability is not catalogued in CISA’s KEV list, but the lack of constraints on the endpoint means that any user who can reach the service could leverage the flaw, making it a significant risk for exposed deployments.