Vulnerability Description
facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/facefusion/facefusion
- https://github.com/facefusion/facefusion/blob/3.6.1/facefusion/jobs/job_manager.
- https://github.com/facefusion/facefusion/commit/a2cbfd73b10191e51ed2eb1e83c19121
- https://github.com/facefusion/facefusion/releases/tag/3.7.0
- https://github.com/geo-chen/oss/blob/main/facefusion.md
- https://www.vulncheck.com/advisories/facefusion-before-3.7.0-path-traversal-via-
- https://github.com/geo-chen/oss/blob/main/facefusion.md
FAQ
What is CVE-2026-84702?
CVE-2026-84702 is a vulnerability with a CVSS score of 7.5 (HIGH). facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job iden...
How severe is CVE-2026-84702?
CVE-2026-84702 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-84702?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.