CVE-2026-13493 | AIDC-AI ComfyUI-Copilot up to 2.0.28 Workflow Checkpoint Restore conversation_api.py resource injection (Issue 149)

A vulnerability, which was classified as problematic, was found in AIDC-AI ComfyUI-Copilot up to 2.0.28. This issue affects some unknown processing of the file backend/controller/conversation_api.py of the component Workflow Checkpoint Restore Handler. Executing a manipulation can lead to improper control of resource identifiers.

This vulnerability appears as CVE-2026-13493. The attack may be performed from remote. In addition, an exploit is available.

The pull request to fix this issue awaits acceptance.