What is CVE-2026-84702?

CVE-2026-84702 is a high-severity vulnerability in Facefusion, classified under Path Traversal. CVSS score: 7.5/10. Published 2026-09-02.

How severe is CVE-2026-84702?

High severity. CVSS v3 base score is 7.5 out of 10.

Path Traversal in Facefusion

CVE-2026-84702

facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations.

Vulnerability class: Path Traversal (Directory Traversal)

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

Affected products

Facefusion

Weakness classification (CWE)

CWE-22 — Path Traversal

References

disclosure@vulncheck.com (product)
disclosure@vulncheck.com (technical-description)
disclosure@vulncheck.com (patch)
disclosure@vulncheck.com (release-notes)
disclosure@vulncheck.com (technical-description)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-84702?: CVE-2026-84702 is a high-severity vulnerability in Facefusion, classified under Path Traversal. CVSS score: 7.5/10. Published 2026-09-02.
How severe is CVE-2026-84702?: High severity. CVSS v3 base score is 7.5 out of 10.