Description

to_abs_path in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but does not resolve symbolic links. A symlink placed inside a scanned directory therefore satisfies the containment comparison performed by is_path_trusted in scripts/iib/api.py while pointing outside that directory, and FileResponse follows the link when serving the response, so a link created in an image directory and targeting a file such as /etc/passwd discloses that file. Whether the check applies depends on get_enable_access_control in scripts/iib/tool.py: it returns true when IIB_ACCESS_CONTROL is set to enable, false when set to disable, and otherwise true when the host Stable Diffusion WebUI was started with share, ngrok, listen or server_name, falling back to false. Confinement is therefore active in the network-exposed WebUI deployments that rely on it, while a standalone run with no such option serves every readable file regardless of this flaw. The fix resolves the path with os.path.realpath.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-21T15:16:47.883Z",
  "pubdate": "2026-08-21T15:16:47.883Z",
  "executiveSummary": "A path traversal vulnerability exists in the IIB extension for Stable Diffusion WebUI, specifically within the path normalization and access control mechanisms implemented in scripts/iib/tool.py and scripts/iib/api.py. The flaw arises because to_abs_path utilizes os.path.normpath, which collapses dot segments but fails to resolve symbolic links. Consequently, an attacker who can place a symbolic link inside a scanned directory can bypass the containment validation performed by is_path_trusted, even though the symbolic link targets locations outside the intended boundary. When FileResponse processes the request, it follows the symlink to serve the referenced file. Successful exploitation leads to arbitrary file disclosure, potentially exposing sensitive system files such as /etc/passwd. The vulnerability affects network-exposed deployments where access control confinement is active—determined by the IIB_ACCESS_CONTROL environment variable or WebUI startup flags such as share, ngrok, listen, or server_name. Standalone runs without these exposure options default to serving readable files regardless, but exposed instances face significant confidentiality risks from unauthenticated or local attackers capable of creating directory structures and symlinks within accessible image paths.",
  "technicalDetails": "The root cause of the vulnerability stems from the improper handling of path normalization and symbolic link resolution within the file-serving pipeline of the application. Specifically, the function to_abs_path located in scripts/iib/tool.py normalizes requested file paths exclusively using os.path.normpath. While os.path.normpath successfully removes redundant separators and dot segments, it lacks the ability to resolve symbolic links to their ultimate canonical targets.\nDuring the validation phase, the function is_path_trusted located in scripts/iib/api.py evaluates the normalized path to ensure it remains within the boundaries of a designated scanned directory. Because to_abs_path does not resolve symlinks, a maliciously crafted symbolic link placed inside a permitted image directory successfully satisfies the containment comparison implemented in is_path_trusted. The path validation check treats the symlink as a standard internal path, failing to recognize that the underlying target resides outside the security perimeter.\nThe exploitation flow proceeds as follows. First, an attacker with write access to an accessible image directory creates a symbolic link pointing to a sensitive system file, such as /etc/passwd. Second, the attacker issues an HTTP request to the application requesting the resource corresponding to the created symlink. Third, the vulnerable routing and response handling mechanisms, specifically utilizing FileResponse, receive the request and follow the symbolic link when retrieving the file content. Finally, the application returns the contents of the target file outside the containment boundary in the HTTP response, resulting in unauthorized file disclosure.\nThe activation of this vulnerability is governed by the access control logic in get_enable_access_control within scripts/iib/tool.py. This function returns true when the environment variable IIB_ACCESS_CONTROL is set to enable, false when set to disable, and defaults to true if the host Stable Diffusion WebUI instance was initiated with command-line flags such as share, ngrok, listen, or server_name. If none of these conditions are met, access control falls back to false. Therefore, confinement and the associated trust checks are actively enforced in network-exposed deployments relying on these security parameters, whereas standalone runs without these configurations serve all readable files indiscriminately."
}