Is CVE-2026-65012 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65012 being exploited in the wild.

How severe is CVE-2026-65012?

Medium severity, with a CVSS score of 5.3, published 22 July 2026.

Is there a fix for CVE-2026-65012?

A patch was published on 2026-07-21: Fix committed to main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65012 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-65012?

Check whether you run InvokeAI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65012: InvokeAI unauthenticated directory enumeration in scan_folder endpoint

CVE-2026-65012 · Severity: medium · CVSS 5.3 · Published 2026-07-22

InvokeAI, an open-source AI image generation tool, contains a security flaw in its multi-user mode that allows unauthorized individuals to browse the server's file system. By sending specific requests to the application, an attacker can discover the names and locations of files and folders on the host machine. This bypasses intended security controls that should restrict administrative functions to authorized users only.

Quick answers

Is CVE-2026-65012 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65012 being exploited in the wild.
How severe is CVE-2026-65012?: Medium severity, with a CVSS score of 5.3, published 22 July 2026.
Which products and versions are affected?: InvokeAI < 6.13.7.
Is there a fix for CVE-2026-65012?: A patch was published on 2026-07-21: Fix committed to main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65012 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-65012?: Check whether you run InvokeAI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authentication check in the 'GET /api/v2/models/scan_folder' endpoint allows unauthenticated attackers to perform directory enumeration when InvokeAI is running in multi-user mode. The endpoint accepts an attacker-controlled 'scan_path' parameter and recursively scans the filesystem for model-related files (e.g., .ckpt, .safetensors). Furthermore, the application returns distinct HTTP status codes (200 for readable, 400 for non-existent, and 500 for exists-but-unreadable), which serves as a filesystem existence oracle. This vulnerability was addressed in version 6.13.7 by requiring administrative authentication for model management endpoints and normalizing error responses.

Affected products

InvokeAI InvokeAI < 6.13.7

Timeline

2026-06-13: disclosed: Vulnerability reported to vendor via email
2026-07-19: other: Public issue opened on GitHub after no response to email
2026-07-21: patched: Fix committed to main branch
2026-07-22: advisory: CVE-2026-65012 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.