{"data":{"id":"e26d0ea0-3c75-4d58-bdc0-05c196336c81","title":"CVE-2024-31462: stable-diffusion-webui is a web interface for Stable Diffusion, implemented using Gradio library…","summary":"stable-diffusion-webui 1.7.0 contains a limited file write flaw affecting Windows systems, tracked as CVE-2024-31462. User input entered into the config_save_name variable in the create_ui method (Backup/Restore tab) in modules/ui_extensions.py reaches save_config_state, where it builds a file path that is opened for writing. An attacker can write JSON files to any location on the server that the web server can access.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-31462","publishedAt":"2024-04-13T02:15:07.320Z","cveId":"CVE-2024-31462","cweIds":["CWE-22"],"cvssScore":"6.3","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["stable-diffusion-webui","Stable Diffusion","Gradio"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"stable-diffusion-webui arbitrary JSON file write via Backup/Restore config save","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.0068,"epssCheckedAt":"2026-11-04T18:09:14.469Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-29T06:09:49.386Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}