CVE-2025-6237

🗓️ 18 Sep 2025 08:34:08Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov👁 15 Views🌐 WEB

CVE-2025-6237 enables path traversal and arbitrary file deletion via image download in invokeai before 6.0.0a1.

Reporter	Title	Published	Views	Family All 13
Huntr	Full system file read and delete via GET /api/v1/images/download/{bulk_download_item_name}	13 Jun 202508:33	–	huntr
Circl	CVE-2025-6237	18 Sep 202511:12	–	circl
CNNVD	Invoke 安全漏洞	18 Sep 202500:00	–	cnnvd
Cvelist	CVE-2025-6237 Path Traversal and Arbitrary File Deletion in invoke-ai/invokeai	18 Sep 202508:34	–	cvelist
EUVD	EUVD-2025-29906	3 Oct 202520:07	–	euvd
Github Security Blog	InvokeAI has External Control of File Name or Path	18 Sep 202509:31	–	github
NVD	CVE-2025-6237	18 Sep 202509:15	–	nvd
OSV	GHSA-VV9C-XXG7-WMV7 InvokeAI has External Control of File Name or Path	18 Sep 202509:31	–	osv
Positive Technologies	PT-2025-38303	18 Sep 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-6237	20 Sep 202509:11	–	redhatcve

[
  {
    "vendor": "invoke-ai",
    "product": "invoke-ai/invokeai",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "versionType": "custom",
        "lessThanOrEqual": "latest"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/54ac9589-7c88-4fd4-8512-8b2f19fbaedf

Parameter	Position	Path	Description	CWE
bulk_download_item_name	path	/api/v1/images/download/{bulk_download_item_name}	Path traversal leading to arbitrary file read/delete via bulk image download endpoint.	CWE-73

15 Apr 2026 00:35Current

6.6Medium risk

Vulners AI Score6.6

CVSS 39.8

EPSS0.00112

SSVC

CWE-73