CVE-2026-123790: ComfyUI-Easy-Use Unauthenticated RCE via the Preview Save Route
The handler had a containment check. It checked the folder, then joined an attacker-chosen filename onto it, then wrote somewhere else entirely. A copy of the same code in its parent project had been fixed two years earlier.