{"id":"CVE-2024-11042","kind":"vulnerability","aliases":["CVE-2024-11042","GHSA-227r-w5j2-6243"],"related":[],"title":"InvokeAI Arbitrary File Deletion vulnerability","description":"In invoke-ai/invokeai version v5.0.2, the web API `POST /api/v1/images/delete` is vulnerable to Arbitrary File Deletion. This vulnerability allows unauthorized attackers to delete arbitrary files on the server, potentially including critical or sensitive system files such as SSH keys, SQLite databases, and configuration files. This can impact the integrity and availability of applications relying on these files.","summary":"InvokeAI, an open-source image generation tool, exposes a web API endpoint (POST /api/v1/images/delete) that does not restrict which file paths it removes. An unauthenticated attacker can delete arbitrary files on the server, such as SSH keys, SQLite databases and configuration files.","severity":"critical","cvss":9.1,"epss":0.01564,"exploited":false,"exploited_at":null,"products":[{"name":"InvokeAI","fixed":["5.3.0rc1"],"affected":"< 5.3.0rc1","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-image-generation","ai-tooling","cwe-20","cwe-22","cwe-73","invokeai","python","self-hosted"],"not_affected_if":["localhost-only-binding","patched-version"],"how_to_check":"- Check the installed version with `pip show InvokeAI` and confirm whether it is below `5.3.0rc1`\n- Confirm the InvokeAI web API is reachable from outside the machine","fix":"- Upgrade the `InvokeAI` PyPI package to `5.3.0rc1` or later","status":"open","published_at":"2025-03-20T10:15:23+00:00","first_seen_at":"2026-10-27T16:51:11+00:00","triaged_at":"2026-10-27T16:52:26+00:00","updated_at":"2026-10-27T17:03:04+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-27T16:52:26Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the `InvokeAI` PyPI package to `5.3.0rc1` or later","reach":"internet","title":"InvokeAI: unauthenticated API call deletes arbitrary files on the server","impact":"high","summary":"InvokeAI, an open-source image generation tool, exposes a web API endpoint (POST /api/v1/images/delete) that does not restrict which file paths it removes. An unauthenticated attacker can delete arbitrary files on the server, such as SSH keys, SQLite databases and configuration files.","category":"ai-tooling","nicknames":[],"who_cares":["invokeai","python","self-hosted","ai-image-generation"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Attacker deletes server files such as SSH keys and databases","analyst_note":"Confirm from the GHSA advisory whether the endpoint requires authentication and what the default bind address is.","how_to_check":"- Check the installed version with `pip show InvokeAI` and confirm whether it is below `5.3.0rc1`\n- Confirm the InvokeAI web API is reachable from outside the machine","needs_analyst":true,"not_affected_if":["localhost-only-binding","patched-version"],"who_is_affected":"Any InvokeAI instance before `5.3.0rc1` whose web interface or API is reachable by an attacker. Instances bound only to localhost or behind a network that blocks outside access are less exposed. The sources do not say whether authentication changes the outcome, so treat exposed instances as at risk.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000626,"input_tokens":3413,"output_tokens":569,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-11042':8A,16A '-20':26B '-2024':7A,15A '-22':28B '-73':30B '/api/v1/images/delete':50B,90C '/invokeai':83C '227r':11A '6243':13A 'ai':19B,23B,82C 'ai-image-gener':18B 'ai-tool':22B 'allow':99C 'api':47B,88C 'applic':133C 'arbitrari':2A,65B,94C,104C 'attack':62B,101C 'avail':131C 'configur':77B,123C 'critic':111C 'cve':6A,14A 'cwe':25B,27B,29B 'databas':75B,121C 'delet':4A,64B,96C,103C 'endpoint':48B 'expos':44B 'file':3A,56B,66B,78B,95C,105C,115C,124C,137C 'generat':21B,42B 'ghsa':10A 'ghsa-227r-w5j2':9A 'host':35B 'imag':20B,41B 'impact':127C 'includ':110C 'integr':129C 'invok':81C 'invoke-ai':80C 'invokeai':1A,17A,31B,36B 'key':73B,119C 'open':39B 'open-sourc':38B 'path':57B 'post':49B,89C 'potenti':109C 'python':32B 'reli':134C 'remov':59B 'restrict':54B 'self':34B 'self-host':33B 'sensit':113C 'server':69B,108C 'sourc':40B 'sqlite':74B,120C 'ssh':72B,118C 'system':114C 'tool':24B,43B 'unauthent':61B 'unauthor':100C 'v5.0.2':85C 'version':84C 'vulner':5A,92C,98C 'w5j2':12A 'web':46B,87C","nicknames":[],"mitigations":[],"who_affected":"Any InvokeAI instance before `5.3.0rc1` whose web interface or API is reachable by an attacker. Instances bound only to localhost or behind a network that blocks outside access are less exposed. The sources do not say whether authentication changes the outcome, so treat exposed instances as at risk.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2025-03-20T10:15:23+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-227r-w5j2-6243","url":"https://github.com/advisories/GHSA-227r-w5j2-6243","severity":"critical","published_at":"2025-03-20T12:32:41+00:00","modified_at":"2026-10-27T16:49:47+00:00","first_seen_at":"2026-10-27T16:51:11+00:00","fetched_at":"2026-10-27T16:51:11+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-11042","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11042","severity":null,"published_at":"2025-03-20T10:15:23+00:00","modified_at":"2026-06-17T06:56:56+00:00","first_seen_at":"2026-10-27T17:03:04+00:00","fetched_at":"2026-10-27T17:03:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}