Path Traversal in Diffusers via Malicious Weight Map

Executive Summary

CVE-2026-65920 is a path traversal vulnerability in the Hugging Face Diffusers library affecting versions up to 0.39.0. The flaw exists in the _get_checkpoint_shard_files function where attackers can manipulate the weight_map parameter in model index JSON files to include directory traversal sequences like ../ or absolute paths. This allows reading arbitrary files outside the intended model directory during model loading.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect model index JSON files (e.g., diffusion_pytorch_model.safetensors.index.json) for malicious weight_map values containing ../ sequences or absolute paths. Check for improper path validation in sharded checkpoints during model loading.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to read sensitive files on your system by exploiting improper path validation during model loading. Attackers could access files like private keys, configuration files, or other sensitive data stored outside the model directory. The impact is limited to file reads and does not enable remote code execution.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements or HIPAA's privacy rules. Organizations using affected Diffusers versions may face compliance violations if sensitive data is exposed through this path traversal flaw.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Hugging Face Diffusers library to a version that includes commit cee298c or later. Validate all shard filenames to ensure they are plain filenames without path separators or parent-directory references. Reject weight_map values containing ../ or absolute paths during model loading.

Useful 0 Not Useful 0