The vulnerability appears in the LoadImage Node of ComfyUI when the function folder_paths.get_annotated_filepath receives a manipulated Name argument. The manipulation enables path traversal, allowing a remote attacker to access files outside the intended directory. Because the exploit is publicly available and remote exploitation is possible, the attacker can read arbitrary files on the system, potentially exposing confidential data or credentials. The weakness is identified as CWE‑22, which denotes path traversal flaws that lead to confidentiality compromise.

All installations of ComfyUI 0.13.0 and earlier are affected. This includes the default build of the LoadImage Node that uses the folder_paths.py component. No specific micro‑versions beyond 0.13.0 are listed as affected, so any version prior to or equal to 0.13.0 should be considered at risk.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is currently unavailable, but the presence of a public exploit and the known remote attack vector raise concern for active exploitation in the field. The vulnerability is not listed in the CISA KEV catalog yet; however, the attacker can achieve significant impact by reading arbitrary files, which could lead to further compromise if sensitive data is accessed. The attack can be executed remotely by invoking the LoadImage Node with a crafted Name parameter over the network interface that the ComfyUI instance exposes.