Description
InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scan_folder endpoint that accepts attacker-controlled scan_path parameters. Unauthenticated attackers can recursively enumerate arbitrary server filesystem directories and use HTTP response codes to determine file existence and readability, bypassing multi-user mode access controls.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| invoke-ai | InvokeAI | < 6.13.7 | 6.13.7 |
References
- Researcher Disclosure technical-description exploit issue-tracking
- InvokeAI 6.13.7 Release Notes release-notes patch
- Pull Request issue-tracking patch
- Patch Commit patch
- https://www.vulncheck.com/advisories/invokeai-unauthenticated-directory-enumeration-via-scan-folder third-party-advisory