Vulnerability · Published Aug 11, 2026 · Assigned by GitHub_M

CVE-2025-31114Fooocus webui vulnerable to Remote Code Execution

Critical 9.3

In plain English

A critical-severity security flaw in Fooocus from lllyasviel. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.9%top 40.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Fooocus is an image generating software. In versions 2.5.5 and prior, the Fooocus web UI is vulnerable to remote code execution due to the unsafe use of eval when processing metadata JSON. An attacker with access to the Fooocus web UI may be able to execute arbitrary code on the instance. As of time of publication, no known patched versions are available, but a suggested fix pull request is available.

Affected products (as reported)

Vendor	Product	Versions
lllyasviel	Fooocus	<= 2.5.5

Weakness: CWE-95 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://securitylab.github.com/advisories/GHSL-2024-196_Fooocus/ x_refsource_CONFIRM
https://github.com/lllyasviel/Fooocus/issues/3552 x_refsource_MISC
https://github.com/lllyasviel/Fooocus/pull/4207 x_refsource_MISC