CyberRota Analysis
AI-GeneratedThe vulnerability in facefusion versions up to 3.6.1 allows unauthenticated attackers to exploit the job identifier parameter in the get_job_file_name function, enabling them to perform directory traversal and write files outside the intended jobs directory. This could lead to unauthorized file creation at arbitrary locations on the server, potentially compromising sensitive data or executing malicious payloads. Organizations using affected versions should prioritize patching this vulnerability to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations.