CVE-2026-77814
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
is_path_trusted in scripts/iib/api.py compares the requested path against allowed parent directories with path.startswith(parent_path), without appending a path separator. A directory whose name merely begins with an allowed path satisfies the comparison, allowing access to files outside the allowed directory.
Risk Assessment
An attacker can access files that should be excluded by the access control mechanism, potentially leading to data leakage.
Recommendation
Upgrade Stable Diffusion WebUI to a version that includes a fix comparing paths with os.sep appended.
Other vulnerabilities in Stable Diffusion WebUI
See all- CVE-2026-111985Medium
A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. It impacts read_metadata_from_safetensors in modules/sd_models.py of the Metadata Extraction component. Manipulating the header length field results in resource allocation, the attack can be launched remotely, and the exploit has been made public. The project was informed but has not responded yet.
- CVE-2026-111984Medium
A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. It affects create_item_html in modules/ui_extra_networks.py of the Card Builder component. Manipulating the filename argument leads to cross site scripting, the attack can be initiated remotely, and the exploit has been disclosed publicly. The project was informed but has not responded yet.
- CVE-2026-82288High
Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradio_auth and api_auth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured usernames and passwords, then use them to authenticate to the interface and access the application.
- CVE-2026-77815High
to_abs_path in scripts/iib/tool.py normalizes the path with os.path.normpath, which does not resolve symbolic links. A symlink placed inside a scanned directory can point outside that directory, and FileResponse follows the link, disclosing files such as /etc/passwd.
Original NVD description (English source)
is_path_trusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswith(parent_path), without appending a path separator. A directory whose name merely begins with an allowed path therefore satisfies the comparison, so where /data/images is allowed a request for /data/images_private/secret.txt is treated as trusted and served by FileResponse, disclosing files the confinement was meant to exclude. Whether the check applies depends on get_enable_access_control in scripts/iib/tool.py: it returns true when IIB_ACCESS_CONTROL is set to enable, false when set to disable, and otherwise true when the host Stable Diffusion WebUI was started with share, ngrok, listen or server_name, falling back to false. Confinement is therefore active in the network-exposed WebUI deployments that rely on it, while a standalone run with no such option serves every readable file regardless of this flaw. The fix compares against parent_path joined with os.sep.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS