Title: Reproduction and Root Cause Analysis – GHSA-2hc9-cc65-xwj8 (CVE-2025-67303)

Summary
- Vulnerability: ComfyUI-Manager prior to v3.38 stored its files under user/default/ComfyUI-Manager, a location reachable via ComfyUI’s /userdata HTTP endpoints when the server is remotely accessible. A remote attacker could read/overwrite Manager configuration and critical data.
- Impact: Integrity high (can lower Manager security_level, influence installation behavior, alter snapshots). CVSS ~7.5 as per advisory.
- Fix: v3.38 migrates Manager data into a protected System User directory user/__manager and blocks access via HTTP endpoints. Old data is backed up and only config.ini is auto-migrated.

What we reproduced
- Using ComfyUI’s actual UserManager (app/user_manager.py) and folder_paths API, we exposed only the /users and /userdata endpoints (mini_server). We created: 
  - Legacy vulnerable path: runtime/user/default/ComfyUI-Manager/config.ini
  - Protected path: runtime/user/__manager/config.ini
- Over HTTP:
  1) GET /userdata/ComfyUI-Manager%2Fconfig.ini returned 200 with file content
  2) POST /userdata/ComfyUI-Manager%2Fconfig.ini modified the file
  3) GET again reflected the change (security_level=weak)
  4) GET /userdata/__manager%2Fconfig.ini did not return 200 (blocked by structural protection)

Evidence (bundle/repro/logs)
- server.log: server start and success message
- step1_get_before.txt: initial content
- step2_post_response.json: upload response path
- step3_get_after.txt: modified content includes security_level = weak
- step4_get_protected.txt: empty (non-200), showing protected path is not exposed

Root cause
- Before v3.38, ComfyUI-Manager persisted config under user/default/ComfyUI-Manager which is inside the public user directory. ComfyUI’s /userdata endpoints allow user-scoped file read/write beneath user/default, enabling remote modification when the server is network-accessible. The System User Protection API and v3.38 migration move Manager data to user/__manager, which is intentionally excluded from HTTP exposure by get_public_user_directory and callers.

Patched behavior
- 3.38+ writes to user/__manager (protected). Even if an attacker can reach /userdata, paths under __manager are structurally blocked and cannot be read/written.

How to run
- See reproduction_steps.sh. Exit code 0 means successfully reproduced; artifacts are written to bundle/repro/logs.