CVE-2026-65920: Diffusers Path Traversal via weight_map Arbitrary File Read

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-23 · updated 2026-10-24
Weakness: CWE-22

Description

Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _get_checkpoint_shard_files function that allows attackers to read arbitrary files by supplying malicious weight_map values in model index JSON. Attackers can use ../ sequences or absolute paths in weight_map entries to escape the model directory and read safetensors files outside the intended location during model loading.

Affected products

huggingface diffusers: through 0.39.0

References

https://github.com/huggingface/diffusers/commit/cee298c1f37c439a9a408396b8283a921238a1c6
https://github.com/huggingface/diffusers/issues/14175
https://github.com/huggingface/diffusers/pull/14182
https://www.vulncheck.com/advisories/diffusers-path-traversal-via-weight-map-arbitrary-file-read

Get alerted when CVE-2026-65920 or the next vulnerability affects your stack