HighVulnerability

CVE-2023-46315: zanllp sd-webui-infinite-image-browsing arbitrary local file read via /file

Source: NVD(opens in a new tab)
Identifier: CVE-2023-46315
Published: October 22, 2023
Record updated: October 9, 2026

Known exploitation: Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS: 0.8%

Summary

The zanllp sd-webui-infinite-image-browsing extension (aka Infinite Image Browsing) before 977815a for stable-diffusion-webui allows remote attackers to read any local file via /file?path= when Gradio authentication is enabled without a secret key configured. The source demonstrates reading /proc/self/environ to discover credentials. The weakness is classified as CWE-200, Exposure of Sensitive Information to an Unauthorized Actor.

Mitigation

The source links a patch commit, 977815a2b28ad953c10ef0114c365f698c4b8f19, in the project's pull request 368, and notes the fix as "before 977815a". It does not state any configuration change or workaround beyond that.

Details

Scores and exploitation

CVSS score: 7.5(high)
EPSS: 0.8%Estimated probability that this CVE is exploited in the next 30 days, from the FIRST Exploit Prediction Scoring System. Read on November 4, 2026.

Weaknesses and techniques

Weakness (CWE): CWE-200
Attack pattern (CAPEC): CAPEC-116

Classification

Attack type: Other
Attack sophistication: Trivial
AI component targeted: Plugin
Impact: Confidentiality
Labels: security

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative. The source gives this advisory a description and no title, so the title above is a headline generated from the source text.

Original source: https://nvd.nist.gov/vuln/detail/CVE-2023-46315

First tracked: February 15, 2026 at 08:47 PM ET, from NVD/CVE Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 90% (self-assessed)

Summary

Mitigation

Related items