EUVD-2026-47744
GHSA-r6m9-hrqm-hx9h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network endpoint with no auth required (AV:N, PR:N); VC:L for filesystem path and file existence disclosure only, with no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scan_folder endpoint that accepts attacker-controlled scan_path parameters. Unauthenticated attackers can recursively enumerate arbitrary server filesystem directories and use HTTP response codes to determine file existence and readability, bypassing multi-user mode access controls.
AnalysisAI
Unauthenticated directory enumeration in InvokeAI before 6.13.7 exposes arbitrary server filesystem paths via the GET /api/v2/models/scan_folder endpoint, which accepts attacker-controlled scan_path parameters without requiring authentication. Beyond path traversal and file existence probing, the vendor's own release notes confirm a closely related attack path capable of recovering full contents of invokeai.yaml and api_keys.yaml - files that may contain API tokens for HuggingFace, Civitai, Alibaba, and OpenAI services. A publicly available exploit exists (GitHub issue #9365); no active exploitation is confirmed in CISA KEV.
Technical ContextAI
InvokeAI is an open-source AI image generation platform built on latent diffusion models. The vulnerable component is the model management REST API (v2), specifically the GET /api/v2/models/scan_folder endpoint, which is designed to scan server directories for compatible model files. The root cause is CWE-306 (Missing Authentication for Critical Function): the endpoint accepts a scan_path query parameter and recursively processes it without enforcing authentication, even in multi-user mode where access controls are expected to partition administrator and regular-user capabilities. The CVSS 4.0 AT:P metric reflects that exploitation is conditioned on the InvokeAI instance being bound to a network-reachable interface (0.0.0.0 or equivalent), a non-default configuration for local single-user installs but common in shared, containerized, or cloud-hosted deployments. CPE cpe:2.3:a:invoke-ai:invokeai:*:*:*:*:*:*:*:* covers all versions prior to 6.13.7.
RemediationAI
Upgrade InvokeAI to version 6.13.7, available at https://github.com/invoke-ai/InvokeAI/releases/tag/v6.13.7. Following the upgrade, rotate all API keys and tokens stored in invokeai.yaml and api_keys.yaml - particularly for HuggingFace, Civitai, Alibaba, and OpenAI - if the instance was ever bound to a network-accessible interface. If immediate upgrade is not possible, restrict the listen host to 127.0.0.1 (localhost only) rather than 0.0.0.0; this prevents remote exploitation but does not address the multi-user mode privilege escalation for locally connected users. Additionally, deploy a reverse proxy or WAF rule to block unauthenticated requests to /api/v2/models/scan_folder as a compensating control; note this requires maintaining proxy rules as the API evolves and is not a substitute for patching.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today