CVE-2026-84702

High

Description

facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations.

SeverityHigh

CVSS7.5

Exploit probability—

ProductFacefusion

PublishedSep 2, 2026

First seenSep 2, 2026

Weakness typeCWE-22Path traversal

How to fix

Update

facefusion facefusion3.7.0 or later

Patches

github.com/facefusion/facefusion/commit/a2cbfd73b10191e51ed2eb1e83c19121153e0a22

Vendor advisories

github.com/facefusion/facefusion/releases/tag/3.7.0

Affected products

Product	Affected versions	Fixed in
facefusion facefusion	v < 3.7.0	3.7.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.