CVE-2026-65012

InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scanfolder endpoint that accepts attacker-controlled scanpath parameters. Unauthenticated attackers can recursively enumerate arbitrary server filesystem directories and use HTTP...

CVE-2026-65012 InvokeAI < 6.13.7 Unauthenticated Directory Enumeration via scan_folder

InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scanfolder endpoint that accepts attacker-controlled scanpath parameters. Unauthenticated attackers can recursively enumerate arbitrary server filesystem directories and use HTTP...

CVE-2026-65012 InvokeAI < 6.13.7 Unauthenticated Directory Enumeration via scan_folder

InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scanfolder endpoint that accepts attacker-controlled scanpath parameters. Unauthenticated attackers can recursively enumerate arbitrary server filesystem directories and use HTTP...

CVE-2026-65012: Missing Authentication for Critical Function

InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scanfolder endpoint that accepts attacker-controlled scanpath parameters. Unauthenticated attackers can recursively enumerate arbitrary server filesystem directories and use HTTP...

CVE-2024-46648

eNMS 4.4.0 to 4.7.1 is vulnerable to Directory Traversal via scanfolder...

CVE-2024-46648: Improper Limitation of a Pathname to a Restricted Directory

eNMS 4.4.0 to 4.7.1 is vulnerable to Directory Traversal via scanfolder...

CVE-2024-46648

eNMS 4.4.0 to 4.7.1 is vulnerable to Directory Traversal via scanfolder...