---
id: CVE-2025-6237
aliases:
  - GHSA-vv9c-xxg7-wmv7
  - PYSEC-2026-359
title: InvokeAI has External Control of File Name or Path
summary: InvokeAI has External Control of File Name or Path
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: invokeai
product: invokeai
ecosystem: pip
affected:
  - invokeai < 6.7.0
patched:
  - invokeai 6.7.0
published: '2025-09-18'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T17:30:37.976036077Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-vv9c-xxg7-wmv7'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-6237'
  - url: >-
      https://github.com/invoke-ai/InvokeAI/pull/8548/commits/eff565ae6ace1c8458f187245690bff0513f1b9e
  - url: 'https://github.com/invoke-ai/InvokeAI'
  - url: >-
      https://github.com/invoke-ai/InvokeAI/blob/v6.0.0a1/invokeai/app/api/routers/images.py#L493-L524
  - url: 'https://github.com/invoke-ai/InvokeAI/releases/tag/v6.7.0'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/invokeai/PYSEC-2026-359.yaml
  - url: 'https://huntr.com/bounties/54ac9589-7c88-4fd4-8512-8b2f19fbaedf'
  - url: 'https://pypi.org/project/invokeai'
  - url: 'https://github.com/advisories/GHSA-vv9c-xxg7-wmv7'
tags:
  - osv
  - pip
  - ghsa
epss: 0.00386
epssPercentile: 0.32529
cwe:
  - CWE-22
  - CWE-73
ingestedAt: '2026-10-27T17:33:23.769Z'
---

## Overview

### Path Traversal Vulnerability in InvokeAI

A path traversal vulnerability in **InvokeAI** (versions < 6.7.0) allows an unauthenticated remote attacker to read files outside the intended media directory via the **bulk downloads** API.

The endpoint accepts a user-controlled file/item name and concatenates it into a filesystem path without proper canonicalization or allow-listing. By supplying sequences such as `../` (or absolute paths), an attacker can cause the server to traverse directories and return arbitrary files.

In certain storage or back-end configurations, abusing attacker-controlled paths can also lead to unintended overwriting or deletion of files referenced by the crafted path.

The issue is fixed in **6.7.0**, which normalizes and validates input paths and rejects traversal attempts.

**Affected versions:** `< 6.7.0`
**Patched version:** `6.7.0`

## Affected packages

- `invokeai < 6.7.0`

## Remediation

Upgrade to a patched release:

- `invokeai 6.7.0`