CVE-2026-84702
facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations.
Zayıflık
facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations.
Kaynaklar
- https://github.com/facefusion/facefusion
- https://github.com/facefusion/facefusion/blob/3.6.1/facefusion/jobs/job_manager.py
- https://github.com/facefusion/facefusion/commit/a2cbfd73b10191e51ed2eb1e83c19121153e0a22
- https://github.com/facefusion/facefusion/releases/tag/3.7.0
- https://github.com/geo-chen/oss/blob/main/facefusion.md
- https://www.vulncheck.com/advisories/facefusion-before-3.7.0-path-traversal-via-job-identifier
Açığı bir saldırgandan önce siz bulun.
GitHub ile giriş yapın ve ilk denetiminizi bir dakikadan kısa sürede başlatın. Ücretsiz plan için kredi kartı gerekmez.