{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/stable-diffusion-webui/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-77815"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Stable Diffusion WebUI"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Stability AI"],"content_html":"\u003cp\u003eCVE-2026-77815 affects the Image-to-Image Browser (IIB) extension within Stable Diffusion WebUI. The vulnerability resides in the \u003ccode\u003eto_abs_path\u003c/code\u003e function located in \u003ccode\u003escripts/iib/tool.py\u003c/code\u003e, which utilizes \u003ccode\u003eos.path.normpath\u003c/code\u003e to normalize file paths. Because \u003ccode\u003eos.path.normpath\u003c/code\u003e does not resolve symbolic links, the path validation logic (\u003ccode\u003eis_path_trusted\u003c/code\u003e) can be bypassed. An attacker who can influence the filesystem by creating a symbolic link within a scanned directory can point that link to sensitive files outside the intended root. If the IIB access control feature is enabled - either manually via the \u003ccode\u003eIIB_ACCESS_CONTROL\u003c/code\u003e environment variable or automatically when the WebUI is launched with network-exposing arguments like \u003ccode\u003e--share\u003c/code\u003e or \u003ccode\u003e--listen\u003c/code\u003e - the \u003ccode\u003eFileResponse\u003c/code\u003e function will follow the symlink and serve the contents of the target file, such as \u003ccode\u003e/etc/passwd\u003c/code\u003e, to the requester.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in arbitrary local file disclosure of any file readable by the user process running the Stable Diffusion WebUI. This poses a significant risk for server-side information disclosure, potentially exposing configuration files, credentials, or system sensitive data in exposed WebUI deployments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpdate the Stable Diffusion WebUI and the Image-to-Image Browser (IIB) extension to the latest version where \u003ccode\u003eos.path.realpath\u003c/code\u003e has replaced \u003ccode\u003eos.path.normpath\u003c/code\u003e for path resolution.\u003c/li\u003e\n\u003cli\u003eFor deployments where the update is not immediately feasible, ensure \u003ccode\u003eIIB_ACCESS_CONTROL\u003c/code\u003e is set to 'disable' only if the deployment is fully isolated and does not require file path confinement, or conversely, restrict filesystem write access to the directories scanned by the extension.\u003c/li\u003e\n\u003cli\u003eAudit the filesystem for unauthorized symbolic links within the directories monitored by the IIB extension.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-21T15:25:32Z","date_published":"2026-08-21T15:25:32Z","id":"https://feed.craftedsignal.io/briefs/2026-08-path-traversal-sd-webui/","summary":"A path traversal vulnerability in Stable Diffusion WebUI allows unauthorized file disclosure via symlink manipulation when IIB access control is active.","title":"Path Traversal in Stable Diffusion WebUI","url":"https://feed.craftedsignal.io/briefs/2026-08-path-traversal-sd-webui/"}],"language":"en","title":"CraftedSignal Threat Feed - Stable Diffusion WebUI","version":"https://jsonfeed.org/version/1.1"}