CVE-2026-84702 Path Traversal in Facefusion

Facefusion versions up to and including 3.6.1 contain a critical path traversal vulnerability within the get_job_file_name function. The application fails to properly sanitize or normalize user-supplied job identifiers provided via the HTTP API. This oversight enables an unauthenticated attacker to inject directory traversal sequences, such as dot-dot-slash patterns, into the job identifier parameter. By manipulating this input, an attacker can escape the intended storage directory and write files to arbitrary locations on the underlying host filesystem. This vulnerability presents a high risk as it facilitates remote code execution if an attacker manages to overwrite sensitive system binaries, configuration files, or startup scripts. Defenders should identify instances of Facefusion in their environment and prioritize upgrading to a patched version once available.

Impact

Successful exploitation of CVE-2026-84702 allows unauthorized file creation and modification on the target server. This can lead to full system compromise, data corruption, or persistent access for an attacker, depending on the ability to overwrite critical system files or web root contents.

Recommendation

• Identify all instances of Facefusion running in the environment and verify the version is above 3.6.1.
• Implement strict ingress filtering for the Facefusion HTTP API to prevent untrusted traffic from reaching the endpoint, particularly for deployments exposed to the internet.
• Monitor web server access logs for requests containing directory traversal patterns (e.g., ../ or ..) within job-related API endpoints.
• Patch Facefusion immediately upon the release of a version addressing CVE-2026-84702.