CVE-2025-6237

🗓️ 18 Sep 2025 08:34:08Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov👁 28 Views🌐 WEB

CVE-2025-6237 enables path traversal and arbitrary file deletion via image download in invokeai before 6.0.0a1.

Reporter	Title	Published	Views	Family All 16
Huntr	Full system file read and delete via GET /api/v1/images/download/{bulk_download_item_name}	13 Jun 202508:33	–	huntr
Circl	CVE-2025-6237	18 Sep 202511:12	–	circl
CNNVD	Invoke 安全漏洞	18 Sep 202500:00	–	cnnvd
Cvelist	CVE-2025-6237 Path Traversal and Arbitrary File Deletion in invoke-ai/invokeai	18 Sep 202508:34	–	cvelist
EUVD	EUVD-2025-29906	3 Oct 202520:07	–	euvd
Github Security Blog	InvokeAI has External Control of File Name or Path	18 Sep 202509:31	–	github
NVD	CVE-2025-6237	18 Sep 202509:15	–	nvd
OSV	GHSA-VV9C-XXG7-WMV7 InvokeAI has External Control of File Name or Path	18 Sep 202509:31	–	osv
OSV	PYSEC-2026-359 InvokeAI has External Control of File Name or Path	29 Jun 202611:50	–	osv
Positive Technologies	PT-2025-38303	18 Sep 202500:00	–	ptsecurity

[
  {
    "vendor": "invoke-ai",
    "product": "invoke-ai/invokeai",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "versionType": "custom",
        "lessThanOrEqual": "latest"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/54ac9589-7c88-4fd4-8512-8b2f19fbaedf

Parameter	Position	Path	Description	CWE
bulk_download_item_name	path	/api/v1/images/download/{bulk_download_item_name}	Path traversal and arbitrary file deletion via the GET /api/v1/images/download/{bulk_download_item_name} endpoint.	CWE-73

17 Jun 2026 10:01Current

6.6Medium risk

Vulners AI Score6.6

CVSS 39.8

EPSS0.00353

SSVC

CWE-73