CVE-2026-65012 in InvokeAI
Summary
by MITRE • 07/22/2026
InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scan_folder endpoint that accepts attacker-controlled scan_path parameters. Unauthenticated attackers can recursively enumerate arbitrary server filesystem directories and use HTTP response codes to determine file existence and readability, bypassing multi-user mode access controls.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability in InvokeAI versions prior to 6.13.7 represents a critical directory enumeration flaw within the application's API endpoint structure. This weakness exists in the GET /api/v2/models/scan_folder endpoint which processes attacker-controlled scan_path parameters without proper authentication or authorization checks. The implementation fails to validate input parameters against legitimate user access rights, creating an unauthenticated pathway for malicious actors to traverse the server's file system hierarchy.
The technical nature of this vulnerability stems from insufficient parameter validation and access control mechanisms within the application's API layer. When an attacker submits a crafted scan_path value to the endpoint, the system processes the request without verifying the caller's credentials or permissions. This allows recursive directory traversal operations that can reveal file structures, determine file existence through HTTP response codes, and assess readability levels of various filesystem locations. The vulnerability specifically targets the model scanning functionality that should only be accessible within the context of authenticated user sessions.
Operationally, this vulnerability presents significant risks to system security and data confidentiality. Attackers can leverage this flaw to map out the server's filesystem structure, identify sensitive files and directories, and potentially discover credentials, configuration files, or other valuable assets stored on the system. The bypass of multi-user mode access controls means that even environments designed to restrict file access based on user roles can be compromised. The ability to use HTTP response codes for file existence determination provides attackers with precise information about the filesystem layout without requiring additional reconnaissance efforts.
The impact extends beyond simple information disclosure as this vulnerability can serve as a foundation for more sophisticated attacks. Once an attacker has mapped the filesystem, they may identify potential privilege escalation paths or locate sensitive data that could be exploited further. This flaw particularly affects environments where InvokeAI serves as a model hosting platform, as it could expose proprietary models, training data, or configuration files that are not intended for public access. The vulnerability's persistence across multiple user sessions and its ability to bypass existing access controls makes it especially dangerous in multi-tenant deployments.
Security mitigations for this vulnerability should focus on implementing strict authentication and authorization checks at the API endpoint level. All requests to the scan_folder endpoint must require valid user credentials and proper access permissions before processing any filesystem operations. Input validation should be enforced to prevent directory traversal attacks, with parameter sanitization ensuring that scan_path values cannot escape the intended scope of operation. The application should implement proper access control lists that restrict filesystem enumeration to authorized users only, preventing unauthorized access even when bypassing authentication mechanisms.
This vulnerability aligns with CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-200 (Information Disclosure) categories, representing a classic case of insufficient input validation combined with inadequate access controls. From an ATT&CK framework perspective, this represents a privilege escalation technique through information gathering, specifically using T1083 (File and Directory Discovery) to map system resources. The vulnerability also demonstrates characteristics of T1566 (Phishing) in that it can be leveraged to gather intelligence for more targeted attacks against the affected environment.
Organizations should immediately upgrade to InvokeAI version 6.13.7 or later where this vulnerability has been addressed through proper authentication enforcement and parameter validation. Additionally, network segmentation and API gateway controls should be implemented to limit access to sensitive endpoints, while comprehensive logging of filesystem access attempts should be enabled for monitoring and incident response purposes. Regular security assessments should verify that similar vulnerabilities do not exist in other API endpoints within the application's attack surface to prevent cascading security issues.