CVE-2026-84702 Details
Description
facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations.
A path traversal vulnerability has been identified in Facefusion versions through 3.6.1. The issue arises in the Job Manager API, where job identifiers are not properly sanitized before being used to construct file paths. This allows attackers to manipulate the job identifier parameter, sending traversal sequences that enable the creation of files in arbitrary locations outside the designated jobs directory. The vulnerability is exposed through an unauthenticated HTTP API, accessible via the Gradio user interface.
Users are advised to update to Facefusion version 3.7.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 2, 2026CISA-ADP
Assessed Sep 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/geo-chen/oss/blob/main/facefusion.md | CISA-ADP | ExploitTechnical Analysis |
| https://github.com/facefusion/facefusion | [email protected] | ProductVendor |
| https://github.com/facefusion/facefusion/blob/3.6.1/facefusion/jobs/job_manager.py | [email protected] | Source CodeVendor |
| https://github.com/facefusion/facefusion/commit/a2cbfd73b10191e51ed2eb1e83c19121153e0a22 | [email protected] | Source CodeVendor |
| https://github.com/facefusion/facefusion/releases/tag/3.7.0 | [email protected] | Release NotesVendor |
| https://github.com/geo-chen/oss/blob/main/facefusion.md | [email protected] | ExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/facefusion-before-3.7.0-path-traversal-via-job-identifier | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| facefusion | >= 0, < 3.7.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 2, 2026 | CVE Modified | CISA-ADP |
| Sep 2, 2026 | New CVE Received | [email protected] |