CVE-2024-11042 CRITICAL

CVE-2024-11042: Arbitrary File Delete in invoke-ai/invokeai

Vendor Invoke-Ai
Product invoke-ai/invokeai
Weakness CWE-73
Published March 20, 2025
Last update October 15, 2025
View on NVD All CVEs

CVSS base score

9.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

What the vulnerability does

01Description

In invoke-ai/invokeai version v5.0.2, the web API `POST /api/v1/images/delete` is vulnerable to Arbitrary File Deletion. This vulnerability allows unauthorized attackers to delete arbitrary files on the server, potentially including critical or sensitive system files such as SSH keys, SQLite databases, and configuration files. This can impact the integrity and availability of applications relying on these files.

Key dates

02Disclosure timeline

March 20, 2025 CVE published
October 15, 2025 Record updated