CVE-2026-65012: Invoke-Ai Invokeai

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scan_folder endpoint that accepts attacker-controlled scan_path parameters. Unauthenticated attackers can recursively enumerate arbitrary server filesystem directories and use HTTP response codes to determine file existence and readability, bypassing multi-user mode access controls.

Affected products

• Invoke-Ai Invokeai: before 6.13.7 (fixed in 6.13.7)

Published 2026-07-22. Last modified 2026-07-23.