Zanllp vulnerabilities
We track 3 vulnerabilities in Zanllp products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 21, 2026.
Latest Zanllp vulnerabilities
- 7.5 High severity
infinite-image-browsing: Improper Link Resolution Before File Access
to_abs_path in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but does not resolve symbolic links. A symlink placed inside a scanned directory therefore satisfies the containment comparison performed by is
- 7.5 High severity
infinite-image-browsing: Improper Limitation of a Pathname to a Restricted Directory
is_path_trusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswith(parent_path), without appending a path separator. A directory whose name merely begins with an allowed path therefore satisfies the com
- 7.5 High severity
Stable Diffusion Webui Infinite Image Browsing: Exposure of Sensitive Information to an Unauthorized Actor
The zanllp sd-webui-infinite-image-browsing (aka Infinite Image Browsing) extension before 977815a for stable-diffusion-webui (aka Stable Diffusion web UI), if Gradio authentication is enabled without secret key configuration, allows remote attackers to read a