CVE-2026-65012 – InvokeAI < 6.13.7 Unauthenticated Directory Enumeration via scan_folder

CVE ID :CVE-2026-65012

Published : 22 juillet 2026 17:16 | 29 minutes ago

Description :InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scan_folder endpoint that accepts attacker-controlled scan_path parameters. Unauthenticated attackers can recursively enumerate arbitrary server filesystem directories and use HTTP response codes to determine file existence and readability, bypassing multi-user mode access controls.

Severity: 6.3 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…