Is CVE-2025-6237 actively exploited?

No active exploitation of CVE-2025-6237 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-6237 be exploited remotely?

Yes. CVE-2025-6237 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2025-6237?

CVE-2025-6237 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2025-6237

CRITICAL

CVE-2025-6237

CWE-73Published: September 18, 2025· Updated: Jun 17, 2026

9.8

CVSS v3.1

Official Description

A vulnerability in invokeai version v6.0.0a1 and below allows attackers to perform path traversal and arbitrary file deletion via the GET /api/v1/images/download/{bulk_download_item_name} endpoint. By manipulating the filename arguments, attackers can read and delete any files on the server, including critical system files such as SSH keys, databases, and configuration files. This vulnerability results in high confidentiality, integrity, and availability impacts.

NVD Source

Technical Analysis

CVE-2025-6237 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.