CVE-2025-65713

Severity: medium (CVSS 4.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-12-23 · updated 2026-10-26
Weakness: CWE-22

Description

Home Assistant Core before v2025.8.0 is vulnerable to Directory Traversal. The Downloader integration does not fully validate file paths during concatenation, leaving a path traversal vulnerability.

Affected products

Home-Assistant: before 2025.8.0 — fixed in 2025.8.0

How to fix

Upgrade to a fixed version: Home-Assistant 2025.8.0. Check the vendor advisory for mitigations.

References

https://gist.github.com/GenoWang/7359360285e0fe21a7a58d10ff71d032
https://github.com/home-assistant/core/pull/150046

Get alerted when CVE-2025-65713 or the next vulnerability affects your stack