CVE-2026-77815
Received Received - Intake

Path Traversal in Stable Diffusion WebUI

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: VulnCheck

Description
to_abs_path in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but does not resolve symbolic links. A symlink placed inside a scanned directory therefore satisfies the containment comparison performed by is_path_trusted in scripts/iib/api.py while pointing outside that directory, and FileResponse follows the link when serving the response, so a link created in an image directory and targeting a file such as /etc/passwd discloses that file. Whether the check applies depends on get_enable_access_control in scripts/iib/tool.py: it returns true when IIB_ACCESS_CONTROL is set to enable, false when set to disable, and otherwise true when the host Stable Diffusion WebUI was started with share, ngrok, listen or server_name, falling back to false. Confinement is therefore active in the network-exposed WebUI deployments that rely on it, while a standalone run with no such option serves every readable file regardless of this flaw. The fix resolves the path with os.path.realpath.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-77815
EUVD
EUVD-2026-63993

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
zanllp infinite-image-browsing 1.8.0
zanllp infinite-image-browsing to 1.8.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77815 is a path traversal vulnerability in the infinite-image-browsing software. It occurs because the to_abs_path function uses os.path.normpath, which does not resolve symbolic links. This allows an attacker to create a symlink inside a scanned directory pointing outside it. When the system serves files via FileResponse, it follows the symlink, potentially exposing sensitive files like /etc/passwd. The flaw is mitigated by using os.path.realpath instead.

Detection Guidance

Check for symlinks in directories served by the application that point outside expected paths. Review access logs for requests accessing files outside intended directories. Use commands like 'find /path/to/scanned/dir -type l -ls' to list symlinks and 'ls -la /path/to/scanned/dir' to inspect suspicious links.

Impact Analysis

This vulnerability allows unauthorized access to sensitive files on the system where infinite-image-browsing is running. Attackers could read files like /etc/passwd or other confidential data by exploiting symlinks. The impact depends on access control settings: network-exposed deployments are vulnerable, while standalone runs may bypass controls if not started with specific options.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive files, such as system files like /etc/passwd, which may contain confidential information. For GDPR, this could result in unauthorized data exposure, violating principles of data protection and user privacy. For HIPAA, it may risk exposing protected health information if such files are accessible, leading to compliance violations and potential data breaches.

Mitigation Strategies

Update to the latest version of infinite-image-browsing that uses os.path.realpath instead of normpath. Disable network exposure if not required. Set IIB_ACCESS_CONTROL=enable to enforce access controls. Review and remove any existing symlinks in scanned directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77815. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart