An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data.
Date: 2026-01
Affected: comfy/comfyui-manager
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2025-67303
CWE: CWE-420
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data. This was due to the application storing its files in an insufficiently protected location that was accessible via the web interface


Mitigations:

Architectural layers (MAESTRO):