Vulnerability · Published Sep 2, 2026 · Assigned by VulnCheck
CVE-2026-84702facefusion before 3.7.0 Path Traversal via Job Identifier
High 7.5
In plain English
A high-severity path traversal in facefusion from facefusion. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 52.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| facefusion | facefusion | 0 – before 3.7.0 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- https://github.com/facefusion/facefusion product
- https://github.com/geo-chen/oss/blob/main/facefusion.md technical-description
- https://github.com/facefusion/facefusion/blob/3.6.1/facefusion/jobs/job_manager.py technical-description
- Patch Commit patch
- facefusion 3.7.0 Release Notes release-notes
- VulnCheck Advisory: facefusion before 3.7.0 Path Traversal via Job Identifier third-party-advisory