Description

facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-02T01:17:25.430Z",
  "pubdate": "2026-09-02T01:17:25.430Z",
  "executiveSummary": "FaceFusion versions up to 3.6.1 contain a critical path traversal vulnerability within the unauthenticated HTTP API.\nThe vulnerability allows remote, unauthenticated attackers to write files to arbitrary locations on the host filesystem by manipulating job identifiers.\nThis occurs because the application fails to adequately normalize user-supplied job identifier inputs before using them to construct file paths in the 'get_job_file_name' function.\nAn attacker can exploit this by supplying path traversal sequences (e.g., ../) within the job identifier parameter, effectively escaping the intended 'jobs' directory.\nSuccessful exploitation results in arbitrary file write capabilities, which can lead to remote code execution (RCE) by overwriting critical application files, configuration files, or injecting malicious payloads into system directories.\nThis vulnerability poses a severe risk to the confidentiality, integrity, and availability of the host system, as it grants attackers significant control over the filesystem without requiring any authentication or prior system access.",
  "technicalDetails": "The vulnerability originates in the 'get_job_file_name' function within FaceFusion through 3.6.1. This function is responsible for mapping user-provided job identifiers to specific file paths on the underlying filesystem where job-related data is stored.\nThe root cause is improper input validation and insufficient sanitization of the job identifier parameter processed by the unauthenticated HTTP API. The application directly incorporates the input into a file path construction process without normalizing the path or stripping directory traversal sequences such as '../'.\nAn attacker can exploit this by crafting a malicious HTTP request to the vulnerable API endpoint, supplying a specially crafted job identifier containing path traversal characters. When the 'get_job_file_name' function processes this input, it resolves the path relative to the intended 'jobs' directory, but the traversal sequences cause the application to climb out of that directory.\nThe attack flow follows these steps: 1. The attacker identifies the API endpoint that accepts a job identifier parameter. 2. The attacker sends a crafted request with a job identifier structured as '..%2f..%2f..%2f[target_path]/[filename]'. 3. The server-side code receives this input and passes it to the vulnerable 'get_job_file_name' function. 4. Due to the lack of normalization, the system interprets the traversal sequences and resolves the final target path to an arbitrary location outside the 'jobs' directory. 5. The application subsequently writes the submitted job data to this attacker-controlled path.\nThis vulnerability does not require authentication, making it accessible to any actor capable of reaching the HTTP API over the network. The impact is significant because it grants the ability to write files to any location for which the application process has write permissions. By overwriting existing files, an attacker could potentially hijack execution flows, inject malicious configuration, or plant executable scripts, leading to full compromise of the application and potentially the host system if the service is running with elevated privileges.\nThis issue represents a failure to adhere to secure coding principles regarding path canonicalization and input validation when interacting with the filesystem."
}