CVE-2026-65920
Diffusers Path Traversal via weight_map Arbitrary File Read
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _get_checkpoint_shard_files function that allows attackers to read arbitrary files by supplying malicious weight_map values in model index JSON. Attackers can use ../ sequences or absolute paths in weight_map entries to escape the model directory and read safetensors files outside the intended location during model loading.
| CWE | CWE-22 |
| Vendor | huggingface |
| Product | diffusers |
| Published | Jul 23, 2026 |
| Last Updated | Jul 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for huggingface diffusers
Be the first to know when new medium vulnerabilities affecting huggingface diffusers are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
huggingface / diffusers
0 ≤ 0.39.0
References
github.com: https://github.com/huggingface/diffusers/issues/14175 github.com: https://github.com/huggingface/diffusers/pull/14182 github.com: https://github.com/huggingface/diffusers/commit/cee298c1f37c439a9a408396b8283a921238a1c6 vulncheck.com: https://www.vulncheck.com/advisories/diffusers-path-traversal-via-weight-map-arbitrary-file-read
Credits
George Chen