CVE-2026-13493

AIDC-AI ComfyUI-Copilot Workflow Checkpoint Restore conversation_api.py resource injection

State: Published
Severity: 2.3 Low
Published: Jun 28, 2026
Updated: Jun 29, 2026
Reserved: Jun 27, 2026

Description

A flaw has been found in AIDC-AI ComfyUI-Copilot up to 2.0.28. This issue affects some unknown processing of the file backend/controller/conversation_api.py of the component Workflow Checkpoint Restore Handler. Executing a manipulation can lead to improper control of resource identifiers. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.

Scores

CVSS	Score	Vector	Source
4.0	2.3 Low	CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	3.1 Low	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R	VulDB
3.0	3.1 Low	CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R	VulDB
2.0	2.1 Low	AV:N/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-99 Improper Control of Resource Identifiers

Affected Products

Product	Versions
ComfyUI-CopilotAIDC-AI	2.0.0Affected 2.0.1Affected 2.0.2Affected 2.0.3Affected 2.0.4Affected 2.0.5Affected 2.0.6Affected 2.0.7Affected 2.0.8Affected 2.0.9Affected 2.0.10Affected 2.0.11Affected 2.0.12Affected 2.0.13Affected 2.0.14Affected 2.0.15Affected 2.0.16Affected 2.0.17Affected 2.0.18Affected 2.0.19Affected 2.0.20Affected 2.0.21Affected 2.0.22Affected 2.0.23Affected 2.0.24Affected and 4 more versions

References

VDB-374489 | AIDC-AI ComfyUI-Copilot Workflow Checkpoint Restore conversation_api.py resource injectionvdb-entry
VDB-374489 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-13493 | CVE Analysis and Reportthird-party-advisory
Submit #838497 | AIDC-AI ComfyUI-Copilot 2.0.28 Insecure Direct Object Reference (IDOR) / Cross-Tenant Data Expothird-party-advisory
https://github.com/AIDC-AI/ComfyUI-Copilot/issues/149exploitissue-tracking
https://github.com/AIDC-AI/ComfyUI-Copilot/pull/150issue-trackingpatch
https://github.com/AIDC-AI/ComfyUI-Copilot/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.