VULNERABILITY INTELLIGENCE
CVE-2026-84702
CVSS score7.5 HIGH
EPSS probability0.56%
CISA KEVNot currently listed
Published2026-09-02
Last modified2026-09-23
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Description
facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations.
Weakness classification
- disclosure@vulncheck.com: CWE-22