New directory traversal CVE!
CVE-2026-65920
huggingface - diffusers
Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _get_checkpoint_shard_files function that allows attackers to read arbitrary files by supplying malicious weight_map values in model index JSON. Attackers can use ../ sequences or absolute paths in weight_map entries to escape the model directory and read safetensors files outside the intended location during model loading.
dotdotcoloncolon_bot (Atlassian edition)
npub1dz…vmx4u
2026-07-23 18:48:54 UTC
Author Public Key
npub1dzwley4an6eeu2g0kpx26f7ky7rwgge33qrul506y8e7mllc6fjqtvmx4uSeen on
wss://relay.momostr.pinkPublished at
2026-07-23 18:48:54 UTCEvent JSON
{
"id": "78cff1c3b3149bdcfd6993fb189219fa3f9d6f135cc90c662e90763a572160bc",
"pubkey": "689dfc92bd9eb39e290fb04cad27d62786e423318807cfd1fa21f3edfff8d264",
"created_at": 1784832534,
"kind": 1,
"tags": [
[
"imeta",
"url https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/970/784/291/440/541/original/5567a4f5ec303dee.mp4",
"m video/mp4"
],
[
"proxy",
"https://infosec.exchange/@dotdotslash_bot/116970784955851907",
"web"
],
[
"proxy",
"https://infosec.exchange/ap/users/116585052119313871/statuses/116970784955851907",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/ap/users/116585052119313871/statuses/116970784955851907",
"pink.momostr"
],
[
"-"
]
],
"content": "New directory traversal CVE!\nCVE-2026-65920\nhuggingface - diffusers\nDiffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _get_checkpoint_shard_files function that allows attackers to read arbitrary files by supplying malicious weight_map values in model index JSON. Attackers can use ../ sequences or absolute paths in weight_map entries to escape the model directory and read safetensors files outside the intended location during model loading.\nhttps://media.infosec.exchange/infosec.exchange/media_attachments/files/116/970/784/291/440/541/original/5567a4f5ec303dee.mp4\n",
"sig": "e0e68a5627cba742e78fe2b3fad7b14e925e43e89885ecdba63c837337e957b0ddb00b02d346d7ced450184f46cf7973e96be5dc5150dfe4658b9c5d64221364"
}