CVE-2024-11042 Arbitrary File Delete in invoke-ai/invokeai
Attackers can delete arbitrary files on the server via the image deletion API, compromising system integrity and availability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-11042?
CVE-2024-11042 is a critical path traversal vulnerability in invoke-ai/invokeai, published on 20 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In invoke-ai/invokeai version v5.0.2, the web API `POST /api/v1/images/delete` is vulnerable to Arbitrary File Deletion. This vulnerability allows unauthorized attackers to delete arbitrary files on the server, potentially including critical or sensitive system files such as SSH keys, SQLite databases, and configuration files. This can impact the integrity and availability of applications relying on these files.
Weakness: CWE-73
Which versions are affected by CVE-2024-11042?
3 open source packages ship an affected version, including invokeai and InvokeAI.
| Package | Affected | Fixed in |
|---|---|---|
invokeai PyPI | All versions | 5.3.0rc1 |
invokeai PyPI | All versions | 5.3.0rc1 |
InvokeAI PyPI | All versions | 5.3.0rc1 |
How do I fix CVE-2024-11042?
Upgrade invokeai to 5.3.0rc1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-11042 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-11042 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-227r-w5j2-6243, PYSEC-2026-358.