PT-2025-12094 · Invokeai · Invokeai

Published 2025-03-20 · Updated 2025-03-22 · CVE-2024-11042

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions invoke-ai/invokeai version v5.0.2

Description The web API POST /api/v1/images/delete is vulnerable to Arbitrary File Deletion, allowing unauthorized attackers to delete arbitrary files on the server. This can include critical or sensitive system files such as SSH keys, SQLite databases, and configuration files, potentially impacting the integrity and availability of applications relying on these files.

Recommendations For invoke-ai/invokeai version v5.0.2, consider disabling the POST /api/v1/images/delete API endpoint until a patch is available to prevent unauthorized file deletion. Restrict access to sensitive system files to minimize the risk of exploitation.

Fix

Path traversal

RCE

Weakness Enumeration

CWE-73

CWE-22

CWE-20

Related Identifiers

CVE-2024-11042

GHSA-227R-W5J2-6243

Affected Products

Invokeai

References · 7

• https://osv.dev/vulnerability/CVE-2024-11042 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-11042 · Security Note
• https://osv.dev/vulnerability/GHSA-227r-w5j2-6243 · Vendor Advisory
• https://github.com/invoke-ai/invokeai/commit/5440c037674882b2ab7acd59087e9bb04b49657a · Note
• https://github.com/invoke-ai/InvokeAI · Note
• https://huntr.com/bounties/635535a7-c804-4789-ac3a-48d951263987 · Note
• https://twitter.com/CVEnew/status/1903336840838647976 · Twitter Post