/Vulnerability Library

ComfyUI-Manager < 3.38 - Configuration Overwrite

CVE-2025-67303
Verified

Description

ComfyUI-Manager < 3.38 contains an insecure file storage vulnerability caused by storing files in an insufficiently protected location accessible via the web interface, letting remote attackers manipulate configuration and critical data, exploit requires web access.

Severity

Critical

CVSS Score

9.8

Exploit Probability

1%

Affected Product

comfyui-manager

Published Date

March 31, 2026

Template Author

maciejklimek

CVE-2025-67303.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2025-67303
CWE ID:
cwe-420

References

https://github.com/Comfy-Org/ComfyUI-Manager/blob/main/docs/en/v3.38-userdata-security-migration.mdhttps://github.com/vulhub/vulhub/blob/master/comfyui/CVE-2025-67303/README.mdhttps://github.com/Comfy-Org/ComfyUI-Manager/blob/main/docs/en/v3.38-userdata-security-migration.md

Remediation Steps

Update to version 3.38 or later.