CVE-2025-31114
Received Received - Intake

Remote Code Execution in Fooocus Web UI

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description
Fooocus is an image generating software. In versions 2.5.5 and prior, the Fooocus web UI is vulnerable to remote code execution due to the unsafe use of eval when processing metadata JSON. An attacker with access to the Fooocus web UI may be able to execute arbitrary code on the instance. As of time of publication, no known patched versions are available, but a suggested fix pull request is available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2025-31114
EUVD
EUVD-2025-210684

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
fooocus fooocus to 2.5.5 (exc)
lllyasviel fooocus to 2.5.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-95 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2025-31114 is a remote code execution (RCE) vulnerability in the Fooocus web UI affecting versions 2.5.5 and prior. It occurs due to unsafe use of the eval() function when processing metadata JSON. Attackers with access to the web UI can execute arbitrary code by uploading crafted metadata containing malicious payloads.

Detection Guidance

Check Fooocus logs for suspicious metadata processing or eval usage. Inspect network traffic for unexpected outbound connections from Fooocus processes. Look for modified image files with embedded malicious metadata in the Fooocus input directory.

Impact Analysis

If you use Fooocus versions 2.5.5 or earlier, an attacker with access to your Fooocus web UI could execute arbitrary code on your system. This could lead to data theft, system compromise, or further network infiltration depending on your environment.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Disable the Fooocus web UI if possible. Restrict network access to Fooocus instances. Monitor for unauthorized code execution attempts. Apply the suggested fix by replacing eval with ast.literal_eval in modules/meta_parser.py if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-31114. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart