Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: invoke-ai Clear all filters
TI-2026-46450 CVE-2026-65012 · GHSA-r6m9-hrqm-hx9h

InvokeAI < 6.13.7 Unauthenticated Directory Enumeration via scan_folder

Priority HIGH 67

InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scan_folder endpoint that accepts attacker-controlled scan_path parameters.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0044 Published 2026-07-22 Fixed in 6.13.7 CWE-306
TI-2025-05643 CVE-2025-6237 · GHSA-vv9c-xxg7-wmv7

Path Traversal and Arbitrary File Deletion in invoke-ai/invokeai

Priority HIGH 82

A vulnerability in invokeai version v6.0.0a1 and below allows attackers to perform path traversal and arbitrary file deletion via the GET /api/v1/images/download/{bulk_download_item_name} endpoint.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.004 Published 2025-09-18 Fixed in 6.7.0 CWE-73
TI-2024-10032 CVE-2024-10821 · GHSA-6f6x-f56q-5xgv

Denial of Service (DoS) in invoke-ai/invokeai

Priority HIGH 72

A Denial of Service (DoS) vulnerability in the multipart request boundary processing mechanism of the Invoke-AI server (version v5.0.1) allows unauthenticated attackers to cause excessive resource consumption.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00636 Published 2025-03-20 No fix listed CWE-835
TI-2024-10230 CVE-2024-11042 · GHSA-227r-w5j2-6243

Arbitrary File Delete in invoke-ai/invokeai

Priority HIGH 78

In invoke-ai/invokeai version v5.0.2, the web API `POST /api/v1/images/delete` is vulnerable to Arbitrary File Deletion.

CVSS 3.0CRITICAL 9.1 Network No auth No interaction EPSS 0.01564 Published 2025-03-20 Fixed in 5.3.0, 5.3.0rc1 CWE-73