CVE-2026-84702
facefusion before 3.7.0 Path Traversal via Job Identifier
- State
- Published
- Severity
- 8.7 High
- Published
- Sep 2, 2026
- Updated
- Sep 2, 2026
- Reserved
- Sep 1, 2026
Description
facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | VulnCheck |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
facefusionfacefusion |
|
References
- https://github.com/facefusion/facefusionproduct
- https://github.com/geo-chen/oss/blob/main/facefusion.mdtechnical-description
- https://github.com/facefusion/facefusion/blob/3.6.1/facefusion/jobs/job_manager.pytechnical-description
- Patch Commitpatch
- facefusion 3.7.0 Release Notesrelease-notes
- VulnCheck Advisory: facefusion before 3.7.0 Path Traversal via Job Identifierthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.