Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2025-31114: Fooocus Web UI Allows Unwanted Code to Run
CVE-2025-31114 · published 2 months ago
Summary
The Fooocus image generating software has a security issue in its web interface. This means an attacker could potentially take control of the software if they gain access to it. Until a patch is available, it's recommended to apply the suggested fix to prevent any potential issues.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| lllyasviel | fooocus | <= 2.5.5 |
Original advisory text
Fooocus webui vulnerable to Remote Code Execution
Fooocus is an image generating software. In versions 2.5.5 and prior, the Fooocus web UI is vulnerable to remote code execution due to the unsafe use of eval when processing metadata JSON. An attacker with access to the Fooocus web UI may be able to execute arbitrary code on the instance. As of time of publication, no known patched versions are available, but a suggested fix pull request is available.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31114... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-31114 Vendor Advisory
- https://securitylab.github.com/advisories/GHSL-2024-196_Fooocus/ Vendor Advisory
- https://github.com/lllyasviel/Fooocus/issues/3552 Third Party Advisory
- https://github.com/lllyasviel/Fooocus/pull/4207 Patch
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-434Unrestricted File Upload
CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Timeline
Published11 Aug 2026
Updated4 Nov 2026
First seen11 Aug 2026
Track software like this
Free during beta