---
id: CVE-2024-11042
aliases:
  - GHSA-227r-w5j2-6243
  - PYSEC-2026-358
title: InvokeAI Arbitrary File Deletion vulnerability
summary: InvokeAI Arbitrary File Deletion vulnerability
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'
vendor: invokeai
product: invokeai
ecosystem: pip
affected:
  - invokeai < 5.3.0rc1
patched:
  - invokeai 5.3.0rc1
published: '2025-03-20'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T17:00:03.982853471Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-227r-w5j2-6243'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-11042'
  - url: >-
      https://github.com/invoke-ai/invokeai/commit/5440c037674882b2ab7acd59087e9bb04b49657a
  - url: 'https://github.com/invoke-ai/InvokeAI'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/invokeai/PYSEC-2026-358.yaml
  - url: 'https://huntr.com/bounties/635535a7-c804-4789-ac3a-48d951263987'
  - url: 'https://pypi.org/project/invokeai'
  - url: 'https://github.com/advisories/GHSA-227r-w5j2-6243'
tags:
  - osv
  - pip
  - exploit-available
  - ghsa
epss: 0.01564
epssPercentile: 0.75153
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/gothburz/CVE-2024-11042'
  checkedAt: '2026-10-27T18:16:08.385Z'
exploitAvailable: true
cwe:
  - CWE-20
  - CWE-22
  - CWE-73
ingestedAt: '2026-10-27T17:33:23.773Z'
---

## Overview

In invoke-ai/invokeai version v5.0.2, the web API `POST /api/v1/images/delete` is vulnerable to Arbitrary File Deletion. This vulnerability allows unauthorized attackers to delete arbitrary files on the server, potentially including critical or sensitive system files such as SSH keys, SQLite databases, and configuration files. This can impact the integrity and availability of applications relying on these files.

## Affected packages

- `invokeai < 5.3.0rc1`

## Remediation

Upgrade to a patched release:

- `invokeai 5.3.0rc1`