CVE-2026-77814: is_path_trusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswith(parent

is_path_trusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswith(parent_path), without appending a p

is_path_trusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswith(parent_path), without appending a path separator. A directory whose name merely begins with an allowed path therefore satisfies the comparison, so where /data/images is allowed a request for /data/images_private/secret.txt is treated as trusted and served by FileResponse, disclosing files the confinement was meant to exclude. Whether the check applies depends on get_enable_access_control in scripts/iib/tool.py: it returns true when IIB_ACCESS_CONTROL is set to enable, false when set to disable, and otherwise true when the host Stable Diffusion WebUI was started with share, ngrok, listen or server_name, falling back to false. Confinement is therefore active in the network-exposed WebUI deployments that rely on it, while a standalone run with no such option serves every readable file regardless of this flaw. The fix compares against parent_path joined with os.sep.

Description from the National Vulnerability Database, published by VulnCheck

What it means for a small business

If your business uses infinite-image-browsing, install the vendor's update. If you're not sure whether you use it, ask whoever manages your computers.

How likely is an attack? The Exploit Prediction Scoring System, run by FIRST (the global association of security response teams), puts the odds of this one being exploited in the next 30 days at 0.50%, higher than 43% of CVEs. That’s low, but low isn’t zero, and the odds jump the day someone publishes an exploit. Scored October 29, 2026, updated daily.

Check your own setup

Website check: reads what your site runs from the outside (WordPress version, plugins it can see, old server software) and matches it against this database.
Server check: what your web server says about itself, and whether that version has known flaws.

Sources

Part of the Huttenlocher Technologies vulnerability database, refreshed twice a day from CISA and the NVD. The title, category and plain-language guidance are ours; check the linked record before acting on a detail. This is general guidance, not a review of your systems.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.