CVE-2026-84702 HIGH

CVE-2026-84702: facefusion before 3.7.0 Path Traversal via Job Identifier

Vendor Facefusion

Product facefusion

Weakness CWE-22 · Path traversal

Published September 2, 2026

Last update September 2, 2026

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations.

Key dates

02Disclosure timeline

September 2, 2026 CVE published

September 2, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-84702 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/22.html AskarLabs — CWE-22 write-up Path Traversal

Related vulnerabilities

04Related CVE

CVE-2026-78657 SigmaForms Pro <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field CVE-2026-59542 WordPress Kali Forms plugin <= 2.4.18 - Arbitrary File Deletion vulnerability CVE-2026-19091 GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision CVE-2026-11426 UnderConstructionPage PRO <= 5.76 - Authenticated (Subscriber+) Arbitrary File Read via template_thumbnail Parameter CVE-2026-67285 Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0