Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-77814— Infinite Image Browsing is_path_trusted Prefix Comparison Omits the Trailing Path Separator

Quick assessment

Affected
zanllp infinite-image-browsing
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

zanllp Infinite Image Browsing是中国zanllp个人开发者的一款无限图片浏览组件。 zanllp Infinite Image Browsing 1.8.0及之前版本存在路径遍历漏洞，该漏洞源于scripts/iib/api.py中的is_path_trusted函数使用path.startswith比较路径且未附加路径分隔符，可能导致路径遍历，泄露本应被隔离的文件。

CVSS 7.5 · High EPSS 0.50% · P42

Possible ATT&CK Techniques 1 AI

T1530 · Data from Cloud Storage

Affected Version Matrix 1

VendorProduct Version RangeStatus
zanllp infinite-image-browsing ≤ 1.8.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-77814

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Infinite Image Browsing is_path_trusted Prefix Comparison Omits the Trailing Path Separator
Source: CVE Program / CVE List V5
Vulnerability Description
is_path_trusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswith(parent_path), without appending a path separator. A directory whose name merely begins with an allowed path therefore satisfies the comparison, so where /data/images is allowed a request for /data/images_private/secret.txt is treated as trusted and served by FileResponse, disclosing files the confinement was meant to exclude. Whether the check applies depends on get_enable_access_control in scripts/iib/tool.py: it returns true when IIB_ACCESS_CONTROL is set to enable, false when set to disable, and otherwise true when the host Stable Diffusion WebUI was started with share, ngrok, listen or server_name, falling back to false. Confinement is therefore active in the network-exposed WebUI deployments that rely on it, while a standalone run with no such option serves every readable file regardless of this flaw. The fix compares against parent_path joined with os.sep.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
zanllp Infinite Image Browsing 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
zanllp Infinite Image Browsing是中国zanllp个人开发者的一款无限图片浏览组件。 zanllp Infinite Image Browsing 1.8.0及之前版本存在路径遍历漏洞，该漏洞源于scripts/iib/api.py中的is_path_trusted函数使用path.startswith比较路径且未附加路径分隔符，可能导致路径遍历，泄露本应被隔离的文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
zanllp infinite-image-browsing 0 ~ 1.8.0 -

II. Public POCs for CVE-2026-77814

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-77814

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-77814 (2)

Vendor Advisories for CVE-2026-77814 (1)

Other References for CVE-2026-77814 (1)

IV. Related Vulnerabilities

Same product: infinite-image-browsing
Same vendor: zanllp
Same weakness: CWE-22