CVE-2024-11042 json
Arbitrary File Delete in invoke-ai/invokeai
published 2025-03-20 19 mo ago modified 2026-10-27 12 d ago also GHSA-227r-w5j2-6243 , PYSEC-2026-358 , EUVD-2025-7073
- cvss
- 9.1
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.6%
- EPSS 1.6% chance of exploitation in 30 days, percentile 75%
- public exploits
- 0
- none known
Summary
In invoke-ai/invokeai version v5.0.2, the web API `POST /api/v1/images/delete` is vulnerable to Arbitrary File Deletion. This vulnerability allows unauthorized attackers to delete arbitrary files on the server, potentially including critical or sensitive system files such as SSH keys, SQLite databases, and configuration files. This can impact the integrity and availability of applications relying on these files.
Patch / fix
- pypi invokeai 5.3.0rc1
- invoke-ai invoke-ai/invokeai 5.3.0
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 19 mo ago
Exploit prediction
1.56% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 9.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
| GitHub | 3.0 | 9.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
| OSV | 3.0 | 9.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | invokeai | <5.3.0rc1 |
5.3.0rc1 |
Affected products
- invoke-ai invoke-ai/invokeai
Classification
References
-
github.com
/invoke-ai/invokeai/commit/5440c037674882b2ab7acd59087e9bb04b49657a
web
-
huntr.com
/bounties/635535a7-c804-4789-ac3a-48d951263987
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-11042
advisory
-
github.com
/invoke-ai/InvokeAI
package
-
github.com
/pypa/advisory-database/tree/main/vulns/invokeai/PYSEC-2026-358.yaml
web
-
pypi.org
/project/invokeai
web, package
-
github.com
/advisories/GHSA-227r-w5j2-6243
advisory
Sources
- CVE List CVE-2024-11042
- GitHub Advisory GHSA-227r-w5j2-6243
- NVD CVE-2024-11042
- OSV PYSEC-2026-358
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.