CVE-2025-6237: falha crítica em invoke-ai/invokeai
Path Traversal and Arbitrary File Deletion in invoke-ai/invokeai
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 0.4%
A vulnerability in invokeai version v6.0.0a1 and below allows attackers to perform path traversal and arbitrary file deletion via the GET /api/v1/images/download/{bulk_download_item_name} endpoint. By manipulating the filename arguments, attackers can read and delete any files on the server, including critical system files such as SSH keys, databases, and configuration files. This vulnerability results in high confidentiality, integrity, and availability impacts.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
invoke-ai · invoke-ai/invokeaiCVEs relacionadas — invoke-ai/invokeai
No mesmo produto, das mais perigosas para as menos.
CVE-2024-12029CRITICALRemote Code Execution via Model Deserialization in invoke-ai/invokeaiEPSS 6.0%CVE-2024-11042CRITICALArbitrary File Delete in invoke-ai/invokeaiEPSS 1.6%CVE-2024-11043HIGHDenial of Service (DoS) via Large Payload in Board Name Field in invoke-ai/invokeaiEPSS 0.7%CVE-2024-10821HIGHDenial of Service (DoS) in invoke-ai/invokeaiEPSS 0.6%