Junglewise Threat Intelligence

CVE-2026-65012: InvokeAI unauthenticated directory enumeration in scan_folder endpoint

CVE-2026-65012 · Severity: medium · CVSS 5.3 · Published 2026-07-22

Executive brief

InvokeAI, an open-source AI image generation tool, contains a security flaw in its multi-user mode that allows unauthorized individuals to browse the server's file system. By sending specific requests to the application, an attacker can discover the names and locations of files and folders on the host machine. This bypasses intended security controls that should restrict administrative functions to authorized users only.

Technical details

A missing authentication check in the 'GET /api/v2/models/scan_folder' endpoint allows unauthenticated attackers to perform directory enumeration when InvokeAI is running in multi-user mode. The endpoint accepts an attacker-controlled 'scan_path' parameter and recursively scans the filesystem for model-related files (e.g., .ckpt, .safetensors). Furthermore, the application returns distinct HTTP status codes (200 for readable, 400 for non-existent, and 500 for exists-but-unreadable), which serves as a filesystem existence oracle. This vulnerability was addressed in version 6.13.7 by requiring administrative authentication for model management endpoints and normalizing error responses.

Affected products

  • InvokeAI InvokeAI < 6.13.7

Timeline

  • 2026-06-13: disclosed: Vulnerability reported to vendor via email
  • 2026-07-19: other: Public issue opened on GitHub after no response to email
  • 2026-07-21: patched: Fix committed to main branch
  • 2026-07-22: advisory: CVE-2026-65012 published

References

Related threats