Skip to main content

External Control of File Name or Path

CVE-2025-6237

High
9.3/10

Summary

A vulnerability in InvokeAI allows attackers to perform Path Traversal and arbitrary file deletion via the GET "/api/v1/images/download/{bulk_download_item_name}" endpoint. By manipulating the filename arguments, attackers can read and delete any files on the server, including critical system files such as SSH keys, databases, and configuration files. This vulnerability results in high confidentiality, integrity, and availability impacts. This issue affects versions prior to 6.7.0rc1.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-73 - External Control of File Name or Path

The software allows user input to control or influence paths or file names that are used in filesystem operations.

References

Advisory Timeline

  • Published