Loading...
Skip to main content
GeekWala

CVE-2025-6237 — Vulnerability in invokeai — CVE Details

CRITICAL

InvokeAI has External Control of File Name or Path

Published September 18, 2025Updated June 29, 2026Source: osv

Summary

### Path Traversal Vulnerability in InvokeAI A path traversal vulnerability in **InvokeAI** (versions < 6.7.0) allows an unauthenticated remote attacker to read files outside the intended media directory via the **bulk downloads** API. The endpoint accepts a user-controlled file/item name and concatenates it into a filesystem path without proper canonicalization or allow-listing. By supplying sequences such as `../` (or absolute paths), an attacker can cause the server to traverse directories and return arbitrary files. In certain storage or back-end configurations, abusing attacker-controlled paths can also lead to unintended overwriting or deletion of files referenced by the crafted path. The issue is fixed in **6.7.0**, which normalizes and validates input paths and rejects traversal attempts. **Affected versions:** `< 6.7.0` **Patched version:** `6.7.0`

Advisory Timeline

  • First published September 18, 2025 (389 days ago).
  • Last revised June 29, 2026 — 284 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

pip
Update invokeai to 6.7.0 or later
pip install "invokeai>=6.7.0"

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: pypi (1).

PackageEcosystemAffectedFixed In
invokeai
pypi
2.2.4.5, 2.2.4.6, 2.2.4.7, 2.2.5 (+238 more)6.7.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2025-6237?
InvokeAI has External Control of File Name or Path This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2025-6237?
CVE-2025-6237 affects invokeai. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-6237 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-vv9c-xxg7-wmv7
PYSEC-2026-359

Related CVEs

More PyPI advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies