CVE-2026-77814
Received Received - Intake

Path Traversal in Stable Diffusion WebUI

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: VulnCheck

Description
is_path_trusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswith(parent_path), without appending a path separator. A directory whose name merely begins with an allowed path therefore satisfies the comparison, so where /data/images is allowed a request for /data/images_private/secret.txt is treated as trusted and served by FileResponse, disclosing files the confinement was meant to exclude. Whether the check applies depends on get_enable_access_control in scripts/iib/tool.py: it returns true when IIB_ACCESS_CONTROL is set to enable, false when set to disable, and otherwise true when the host Stable Diffusion WebUI was started with share, ngrok, listen or server_name, falling back to false. Confinement is therefore active in the network-exposed WebUI deployments that rely on it, while a standalone run with no such option serves every readable file regardless of this flaw. The fix compares against parent_path joined with os.sep.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-77814
EUVD
EUVD-2026-63992

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zanllp infinite-image-browsing to 1.8.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77814 is a path traversal vulnerability in the Infinite Image Browsing application. The is_path_trusted function in scripts/iib/api.py uses startswith(parent_path) to check if a requested path is trusted. This check fails to account for trailing path separators, allowing directories with names starting with an allowed path to bypass restrictions. For example, /data/images_private/secret.txt could be treated as trusted if /data/images is allowed. The flaw also involves symlink escapes due to improper path resolution.

Detection Guidance

Check if the Infinite Image Browsing application is running with access control enabled. Inspect the logs for requests accessing files outside intended directories. Verify if the is_path_trusted function in scripts/iib/api.py is vulnerable by testing paths like /data/images_private/secret.txt when /data/images is allowed.

Impact Analysis

This vulnerability allows attackers to access files outside intended directories, potentially exposing sensitive data like images, documents, or configuration files. In network-exposed WebUI deployments, confinement is active but flawed, while standalone runs without specific options serve all readable files. Attackers could exploit this to read unauthorized files, including those containing private information.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive files, potentially violating data protection requirements under GDPR (e.g., Article 32 on security of processing) and HIPAA (e.g., 45 CFR § 164.312(a)(1) on access control). Unauthorized disclosure of personal or health data may result in non-compliance.

Mitigation Strategies

Update to the latest version of Infinite Image Browsing where the fix is applied. Ensure access control is enabled by setting IIB_ACCESS_CONTROL=enable. Modify the is_path_trusted function to use os.path.realpath() and append os.sep to parent_path in the startswith check.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77814. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart