ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)

Impact

An Unprotected Alternate Channel (CWE-420) vulnerability was discovered in ComfyUI-Manager versions prior to 3.38.

Vulnerability Details

In affected versions, ComfyUI-Manager stored its configuration in the user/default/ComfyUI-Manager/ directory, which was accessible via ComfyUI's web APIs without proper access control. This unprotected alternate channel allowed remote attackers to read and manipulate configuration files and critical data through the web interface.

Potential Attack Scenarios

An attacker exploiting this vulnerability could:

• Modify security settings: Lower the security level from "strong" to "weak" to enable more dangerous operations
• Tamper with custom node sources: Add malicious custom node repositories
• Manipulate snapshot data: Corrupt or alter system snapshots
• Change manager behavior: Alter various manager configuration settings

Affected Configurations

Configuration	Risk Level
Systems running with --listen 0.0.0.0 (externally exposed)	HIGH
Systems behind reverse proxy without proper access control	MEDIUM
Local-only installations (default, localhost only)	NOT AFFECTED

---

Patches

This issue has been patched in ComfyUI-Manager version 3.38.

Requirements

Component	Minimum Version	Notes
ComfyUI	v0.3.76+	Required for System User Protection API
ComfyUI-Manager	v3.38+	Contains the security fix

What the Patch Does

1. Path Migration: Configuration files moved from unprotected user/default/ComfyUI-Manager/ to protected user/__manager/
2. Protected Directory: The new __manager/ directory leverages ComfyUI's System User Protection API, which blocks external web API access
3. Security Level Enforcement: Settings below "normal" are automatically raised to "normal" during migration