Critical severity9.8GHSA Advisory· Published Sep 18, 2025· Updated Apr 15, 2026
CVE-2025-6237
CVE-2025-6237
Description
A vulnerability in invokeai version v6.0.0a1 and below allows attackers to perform path traversal and arbitrary file deletion via the GET /api/v1/images/download/{bulk_download_item_name} endpoint. By manipulating the filename arguments, attackers can read and delete any files on the server, including critical system files such as SSH keys, databases, and configuration files. This vulnerability results in high confidentiality, integrity, and availability impacts.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
invokeaiPyPI | < 6.7.0 | 6.7.0 |
Affected products
2Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-vv9c-xxg7-wmv7ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-6237ghsaADVISORY
- github.com/invoke-ai/InvokeAI/blob/v6.0.0a1/invokeai/app/api/routers/images.pyghsaWEB
- github.com/invoke-ai/InvokeAI/pull/8548/commits/eff565ae6ace1c8458f187245690bff0513f1b9eghsaWEB
- github.com/invoke-ai/InvokeAI/releases/tag/v6.7.0ghsaWEB
- huntr.com/bounties/54ac9589-7c88-4fd4-8512-8b2f19fbaedfnvdWEB
News mentions
0No linked articles in our index yet.