InvokeAI versions older than 6.13.7 expose a GET endpoint at /api/v2/models/scan_folder that accepts a user‑supplied scan_path parameter. Because no authentication is required, an external actor can supply arbitrary paths and the endpoint will recursively traverse the server filesystem. The HTTP status codes returned reveal whether a file or directory exists and whether it can be read, allowing an attacker to map sensitive data locations. This flaw, a credential‑related weakness (CWE‑306), permits unilateral information disclosure and undermines the confidentiality guarantees of the multi‑user mode.

The affected product is invoke‑ai:InvokeAI. The release notes for v6.13.7 contain the fix, therefore any deployment running 6.13.6 or earlier is considered vulnerable. The input does not list a precise fixed‑version range, but it is inferred from the version hierarchy that all pre‑6.13.7 builds lack the restriction.

The CVSS score of 6.3 indicates a moderate severity. The EPSS score of <1% suggests a low probability of exploitation reported in the public data set, yet the vulnerability requires only unauthenticated HTTP GET requests and no special privileges, making the attack path straightforward for any actor who can reach the endpoint. It is not listed in the CISA KEV catalog, but the lack of authentication means it can facilitate further reconnaissance or privilege escalation, especially in multi‑user deployments.