CVE-2026-77815 affects the Infinite Image Browsing extension for Stable Diffusion WebUI. The vulnerability stems from the use of os.path.normpath in the to_abs_path function, which collapses dot segments but does not resolve symbolic links. An attacker can place a symlink inside a scanned directory that points to sensitive files outside the directory, such as /etc/passwd, bypassing the is_path_trusted containment check. The FileResponse handler then follows the symlink and serves the targeted file, resulting in arbitrary file disclosure. The flaw is most impactful in network-exposed deployments where access control is active (e.g., when using share, ngrok, listen, or server_name options). The fix replaces os.path.normpath with os.path.realpath to properly resolve symbolic links before path comparison.
