Arbitrary File Upload Leading to RCE in ComfyUI-Manager
Tencent Xuanwu Lab has identified a high-severity vulnerability (CVE-2025-67303) in ComfyUI-Manager, the integrated extension component of the visual AI workflow tool ComfyUI. In out-of-the-box configurations, this flaw allows a remote attacker to compromise the system without any authentication. By bypassing security restrictions, an attacker can execute arbitrary code, leading to full server compromise.
The issue has been patched in the latest version of ComfyUI-Manager.