Critical · published March 20, 2025
🚨 One careless API call can open the floodgates! An attacker can delete any file they want on the server with a simple request to the `/api/v1/images/delete` endpoint in invoke-ai/invokeai version v5.0.2. 🔥 Think of this vulnerability like giving a pizza delivery person a master key to your kitchen — if they can access any room, they could throw out essential ingredients or even the entire recipe book! The implications are absolutely devastating. An attacker could wipe out critical files like SSH keys or configuration documents, jeopardizing the integrity and availability of your applications. This could lead to downtime, data loss, and a massive headache for your team.
Think of this vulnerability like giving a pizza delivery person a master key to your kitchen — if they can access any room, they could throw out essential ingredients or even the entire recipe book! This vulnerability in invoke-ai allows unauthorized users to make a `POST` request that can delete any arbitrary file on the server, exposing it to severe risks if exploited.
The implications are absolutely devastating. An attacker could wipe out critical files like SSH keys or configuration documents, jeopardizing the integrity and availability of your applications. This could lead to downtime, data loss, and a massive headache for your team. Immediately patch to version v5.0.3 to close this vulnerability. Review your API security practices to ensure that only authorized requests can be made to sensitive endpoints, and consider implementing stricter access controls. 🔒 You've got this! Act fast to secure your server and keep everything running smoothly. 🛡️