CVE-2026-65012

Name of the Vulnerable Software and Affected Versions InvokeAI versions prior to 6.13.7

Description An unauthenticated directory enumeration issue exists in the 'GET /api/v2/models/scan folder' endpoint. The endpoint accepts a scan path parameter that can be controlled by an attacker, allowing them to recursively enumerate arbitrary directories on the server filesystem. By analyzing HTTP response codes, an attacker can determine if files exist and are readable, which bypasses access controls implemented for multi-user mode.

Recommendations Update to version 6.13.7 or later. As a temporary mitigation, restrict access to the 'GET /api/v2/models/scan folder' endpoint or avoid using the scan path parameter until the update is applied.