CVE-2026-13493CWE-99

AIDC-AI ComfyUI-Copilot Workflow Checkpoint Restore conversation_api.py resource injection

Low · published June 28, 2026

CVSS v4.0
2.3
EPSS
0%
Percentile
29.2
In the wild
Unconfirmed
What it is

A flaw has been found in AIDC-AI ComfyUI-Copilot up to 2.0.28. This issue affects some unknown processing of the file backend/controller/conversation_api.py of the component Workflow Checkpoint Restore Handler. Executing a manipulation can lead to improper control of resource identifiers. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00365 · 29.2th percentile
Weakness
CWE-99 · Improper Control of Resource Identifiers ('Resource Injection')
Published
2026-06-28T12:00Z
EPSS history
Timeline
  • 28 JUN 12:00Z
    AIDC-AI ComfyUI-Copilot Workflow Checkpoint Restore conversation_api.py resource injection
    cvelistv5