Advisoriesby IbisInvokeAIGHSA-227r-w5j2-6243
InvokeAI Arbitrary File Deletion vulnerability
Fix: upgrade to 5.3.0rc1 or later
In invoke-ai/invokeai version v5.0.2, the web API POST /api/v1/images/delete is vulnerable to Arbitrary File Deletion. This vulnerability allows unauthorized attackers to delete arbitrary files on the server, potentially including critical or sensitive system files such as SSH keys, SQLite databases, and configuration files. This can impact the integrity and availability of applications relying on these files.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| invokeai PyPI | < 5.3.0rc1 | 5.3.0rc1 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-20, CWE-22, CWE-73
- Also known as
- CVE-2024-11042, PYSEC-2026-358
- nvd.nist.gov/vuln/detail/CVE-2024-11042
- github.com/invoke-ai/invokeai/commit/5440c037674882b2ab7acd59087e9bb04b49657a
- github.com/invoke-ai/InvokeAI
- github.com/pypa/advisory-database/tree/main/vulns/invokeai/PYSEC-2026-358.yaml
- huntr.com/bounties/635535a7-c804-4789-ac3a-48d951263987
- pypi.org/project/invokeai
More InvokeAI advisories
All InvokeAI
InvokeAI has External Control of File Name or PathCVE-2025-6237fixed in 6.7.0InvokeAI Deserialization of Untrusted Data vulnerabilityCVE-2024-12029fixed in 5.4.3rc2InvokeAI Uncontrolled Resource Consumption vulnerabilityCVE-2024-11043no fix yetInvokeAI has Denial of Service (DoS) vulnerability in `/api/v1/images/upload`CVE-2024-10821no fix yet