CVE-2025-6237

描述

### Path Traversal Vulnerability in InvokeAI A path traversal vulnerability in **InvokeAI** (versions < 6.7.0) allows an unauthenticated remote attacker to read files outside the intended media directory via the **bulk downloads** API. The endpoint accepts a user-controlled file/item name and concatenates it into a filesystem path without proper canonicalization or allow-listing. By supplying sequences such as `../` (or absolute paths), an attacker can cause the server to traverse directories and return arbitrary files. In certain storage or back-end configurations, abusing attacker-controlled paths can also lead to unintended overwriting or deletion of files referenced by the crafted path. The issue is fixed in **6.7.0**, which normalizes and validates input paths and rejects traversal attempts. **Affected versions:** `< 6.7.0` **Patched version:** `6.7.0`

如何修補 CVE-2025-6237

要修補 CVE-2025-6237,請將受影響套件升級到下列已修補版本。

• —升級至 6.7.0 或更新版本

CVE-2025-6237 正在被利用嗎?

低 — EPSS 為 0.4%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 6.7.0

CVSS 分數

參考連結(8)

• ADVISORYgithub.com/advisories/GHSA-vv9c-xxg7-wmv7
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2025-6237
• PATCHgithub.com/invoke-ai/InvokeAI
• PATCHpypi.org/project/invokeai
• WEB