Path Traversal and File Deletion Vulnerability in InvokeAI by CompVis

CVE-2025-6237

What is CVE-2025-6237?

A vulnerability exists in InvokeAI version v6.0.0a1 and prior, enabling attackers to exploit the GET /api/v1/images/download/{bulk_download_item_name} endpoint. This exploit permits unauthorized manipulation of filename arguments, leading to unauthorized access to sensitive files on the server. Consequences may include the ability to read or delete critical files such as SSH keys, databases, and configuration files, significantly compromising system security.

References