GitHub Advisoryadvisory · PyPI

GHSA-227r-w5j2-6243 InvokeAI Arbitrary File Deletion vulnerability

CRITICAL Published 2025-03-20 Modified 2026-10-27 Official page ↗
Aliases
CVE-2024-11042
Ecosystem
PyPI
Packages
InvokeAI
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-20, CWE-22, CWE-73
Reviewed
2025-03-21

Affected packages

• PyPI InvokeAI: < 5.3.0rc1 → fixed in 5.3.0rc1

Description

In invoke-ai/invokeai version v5.0.2, the web API `POST /api/v1/images/delete` is vulnerable to Arbitrary File Deletion. This vulnerability allows unauthorized attackers to delete arbitrary files on the server, potentially including critical or sensitive system files such as SSH keys, SQLite databases, and configuration files. This can impact the integrity and availability of applications relying on these files.

Related

Alias · CVE (1)

  • CVE-2024-11042 In invoke-ai/invokeai version v5.0.2, the web API `POST /api/v1/images/delete` is vulnerable to Arbitrary File Deletion. vulnerability

Weakness · CWE (3)

  • CWE-20 Improper Input Validation weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-73 External Control of File Name or Path weakness

References