InvokeAI version prior to 5.3.0rc1 contains an arbitrary file deletion vulnerability in its web API endpoint POST /api/v1/images/delete. This flaw allows unauthorized attackers to delete arbitrary files on the server, including critical system files such as SSH keys, SQLite databases, and configuration files, impacting application integrity and availability. A patch is available in version 5.3.0rc1.