InvokeAI has External Control of File Name or Path
Path Traversal Vulnerability in InvokeAI
A path traversal vulnerability in InvokeAI (versions < 6.7.0) allows an unauthenticated remote attacker to read files outside the intended media directory via the bulk downloads API.
The endpoint accepts a user-controlled file/item name and concatenates it into a filesystem path without proper canonicalization or allow-listing. By supplying sequences such as ../ (or absolute paths), an attacker can cause the server to traverse directories and return arbitrary files.
In certain storage or back-end configurations, abusing attacker-controlled paths can also lead to unintended overwriting or deletion of files referenced by the crafted path.
The issue is fixed in 6.7.0, which normalizes and validates input paths and rejects traversal attempts.
Affected versions: < 6.7.0
Patched version: 6.7.0
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | invokeai | < 6.7.0 | 6.7.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-6237
- https://github.com/invoke-ai/InvokeAI/pull/8548/commits/eff565ae6ace1c8458f187245690bff0513f1b9e
- https://github.com/invoke-ai/InvokeAI
- https://github.com/invoke-ai/InvokeAI/blob/v6.0.0a1/invokeai/app/api/routers/images.py#L493-L524
- https://github.com/invoke-ai/InvokeAI/releases/tag/v6.7.0
- https://huntr.com/bounties/54ac9589-7c88-4fd4-8512-8b2f19fbaedf
- https://pypi.org/project/invokeai
- https://github.com/advisories/GHSA-vv9c-xxg7-wmv7
- CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-22, CWE-73- Platform
- Python (PyPI)
- Package
invokeai- Disclosed
- 18.09.2025
- Updated
- 11.10.2026 12:20
Sources and licenses
OSV / GitHub Advisory Database - GHSA-vv9c-xxg7-wmv7 - CC BY 4.0
OSV / GitHub Advisory Database - PYSEC-2026-359 - PyPA Advisory Database; CC BY 4.0
Vulnerability history: invokeai
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 5
- First → latest
- 03.2025 09.2025
- Without a fix
- 2
- Exploited in attacks
- 0
Severity breakdown
- Critical 3
- High 2
Disclosures per year
- 2025: 5
- 2026: 0
-
InvokeAI has External Control of File Name or Path this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.