Directory traversal vulnerability in InvokeAI image deletion
InvokeAI contained a directory traversal vulnerability in image deletion that could allow unauthorized deletion of files outside the intended output folder. The vulnerability was fixed with path validation and boundary checks.
What happened
InvokeAI contained a directory traversal vulnerability in its image deletion functionality that could allow attackers to delete arbitrary files outside the intended output folder.
The vulnerability was in the get_path method of the image_files_disk.py module, which did not properly validate image file paths before deletion operations.
Index analysis
The fix implemented path validation to strip and reject any path information containing directory traversal sequences, and added checks to ensure resolved paths remain within the base output folder.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.