Description
is_path_trusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswith(parent_path), without appending a path separator. A directory whose name merely begins with an allowed path therefore satisfies the comparison, so where /data/images is allowed a request for /data/images_private/secret.txt is treated as trusted and served by FileResponse, disclosing files the confinement was meant to exclude. Whether the check applies depends on get_enable_access_control in scripts/iib/tool.py: it returns true when IIB_ACCESS_CONTROL is set to enable, false when set to disable, and otherwise true when the host Stable Diffusion WebUI was started with share, ngrok, listen or server_name, falling back to false. Confinement is therefore active in the network-exposed WebUI deployments that rely on it, while a standalone run with no such option serves every readable file regardless of this flaw. The fix compares against parent_path joined with os.sep.
Published: 2026-08-21
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Directory traversal leading to arbitrary file disclosure
Action: Apply patch
AI Analysis

Impact

The is_path_trusted helper in Infinite Image Browsing compares the requested file path against an allowed base directory using a startswith check that omits the trailing path separator. A path such as /data/images_private/secret.txt starts with /data/images and therefore is considered trusted, causing the application to serve files outside the intended image directory. This flaw allows an attacker to read any file that the web process can access, exposing confidential or proprietary data.

Affected Systems

The vulnerability affects the zanllp infinite-image-browsing plugin, packaged as the SD‑WebUI Infinite Image Browsing component. The CVE payload does not specify any affected release range, so the scope is limited to deployments of the plugin when version information is unavailable.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity. EPSS data is not available and the issue is not listed in the CISA KEV catalog, but the flaw is active when access control is enabled in network‑exposed Stable Diffusion WebUI deployments. A network‑demonstrable exploit can be triggered via the web interface, allowing an attacker to read arbitrary files beyond the configured directories. The weakness is a directory traversal (CWE‑22) that permits reading files outside the intended confinement.

Generated by OpenCVE AI on August 21, 2026 at 17:06 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest version of Infinite Image Browsing that includes the parent_path separator fix.
  • In the meantime, disable the access control feature for any public or internet‑exposed WebUI deployments until a patch is available.
  • Ensure that file access checks validate full canonical paths and enforce the correct directory boundaries before serving files.

Generated by OpenCVE AI on August 21, 2026 at 17:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 15:15:00 +0000

Type Values Removed Values Added
Description is_path_trusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswith(parent_path), without appending a path separator. A directory whose name merely begins with an allowed path therefore satisfies the comparison, so where /data/images is allowed a request for /data/images_private/secret.txt is treated as trusted and served by FileResponse, disclosing files the confinement was meant to exclude. Whether the check applies depends on get_enable_access_control in scripts/iib/tool.py: it returns true when IIB_ACCESS_CONTROL is set to enable, false when set to disable, and otherwise true when the host Stable Diffusion WebUI was started with share, ngrok, listen or server_name, falling back to false. Confinement is therefore active in the network-exposed WebUI deployments that rely on it, while a standalone run with no such option serves every readable file regardless of this flaw. The fix compares against parent_path joined with os.sep.
Title Infinite Image Browsing is_path_trusted Prefix Comparison Omits the Trailing Path Separator
First Time appeared Zanllp
Zanllp sd-webui-infinite Image Browsing
Weaknesses CWE-22
CPEs cpe:2.3:a:zanllp:sd-webui-infinite_image_browsing:*:*:*:*:*:*:*:*
Vendors & Products Zanllp
Zanllp sd-webui-infinite Image Browsing
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Zanllp Sd-webui-infinite Image Browsing
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-21T17:33:29.308Z

Reserved: 2026-08-21T14:14:43.820Z

Link: CVE-2026-77814

cve-icon Vulnrichment

Updated: 2026-08-21T17:33:00.486Z

cve-icon NVD

Status : Received

Published: 2026-08-21T15:16:47.733

Modified: 2026-08-21T18:16:52.723

Link: CVE-2026-77814

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T20:30:07Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')