CVE-2025-6237
Path Traversal and Arbitrary File Deletion in invoke-ai/invokeai
- State
- Published
- Severity
- 9.8 Critical
- Published
- Sep 18, 2025
- Updated
- Sep 18, 2025
- Reserved
- Jun 18, 2025
Description
A vulnerability in invokeai version v6.0.0a1 and below allows attackers to perform path traversal and arbitrary file deletion via the GET /api/v1/images/download/{bulk_download_item_name} endpoint. By manipulating the filename arguments, attackers can read and delete any files on the server, including critical system files such as SSH keys, databases, and configuration files. This vulnerability results in high confidentiality, integrity, and availability impacts.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 9.8 Critical | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | @huntr_ai |
Weaknesses
- CWE-73 External Control of File Name or Path
Affected Products
| Product | Versions |
|---|---|
invoke-ai/invokeaiinvoke-ai |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.