CVE-2026-84702

CVE-2026-84702 is a path traversal flaw (CWE-22) in the open-source FaceFusion face-swap application, which fails to normalize job identifiers in get_job_file_name. An unauthenticated attacker can submit traversal sequences (e.g., ../) in the job identifier parameter of the HTTP API, causing files to be written outside the intended jobs directory. This yields creation or overwriting of files at arbitrary filesystem locations with the privileges of the FaceFusion service (CVSS 4.0 8.7, high integrity impact); no code execution or file read is indicated by the advisory. Anyone running FaceFusion 3.6.1 or earlier with its unauthenticated HTTP API reachable from an untrusted network is affected, while strictly local deployments are largely out of reach. No exploitation has been observed, no public proof-of-concept is known, and EPSS estimates only a 0.4% chance of exploitation within 30 days.

What to do: Upgrade FaceFusion to a release newer than 3.6.1 as soon as a patched version is published, and monitor the project's GitHub repository for the fix. Until then, restrict the HTTP API to trusted networks or localhost (e.g., via firewall rules or reverse proxy with authentication) and do not expose it directly to the internet. Audit systems for unexpected files written outside the jobs directory, which would indicate attempted exploitation.