A vulnerability in invokeai version v6.0.0a1 and below allows attackers to perform path traversal and arbitrary file deletion via the GET /api/v1/images/download/{bulk_download_item_name} endpoint. By manipulating the filename arguments, attackers can read and delete any files on the server, including critical system files such as SSH keys, databases, and configuration files. This vulnerability results in high confidentiality, integrity, and availability impacts.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Invoke-ai |
|
No data.
No data.
References
History
Thu, 18 Sep 2025 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 18 Sep 2025 12:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Invoke-ai
Invoke-ai invokeai |
|
| Vendors & Products |
Invoke-ai
Invoke-ai invokeai |
Thu, 18 Sep 2025 08:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A vulnerability in invokeai version v6.0.0a1 and below allows attackers to perform path traversal and arbitrary file deletion via the GET /api/v1/images/download/{bulk_download_item_name} endpoint. By manipulating the filename arguments, attackers can read and delete any files on the server, including critical system files such as SSH keys, databases, and configuration files. This vulnerability results in high confidentiality, integrity, and availability impacts. | |
| Title | Path Traversal and Arbitrary File Deletion in invoke-ai/invokeai | |
| Weaknesses | CWE-73 | |
| References |
| |
| Metrics |
cvssV3_0
|
MITRE
Status: PUBLISHED
Assigner: @huntr_ai
Published: 2025-09-18T08:34:08.039Z
Updated: 2025-09-18T13:31:31.235Z
Reserved: 2025-06-18T13:49:09.251Z
Link: CVE-2025-6237
Vulnrichment
Updated: 2025-09-18T13:31:27.636Z
NVD
Status : Awaiting Analysis
Published: 2025-09-18T09:15:35.557
Modified: 2025-09-18T14:15:50.343
Link: CVE-2025-6237
Redhat
No data.