CVE-2026-65920: Diffusers path traversal

CISO Take

A path traversal flaw in Diffusers' checkpoint-loading code lets a malicious model's index JSON specify weight_map entries containing '../' sequences or absolute paths, causing the library to read arbitrary files on disk instead of the expected safetensors shard. Diffusers underpins image-generation pipelines with 419 downstream dependents, and its OpenSSF Scorecard of 4.4/10 and package risk score of 26/100 already flag it as a below-average security posture, so this adds a concrete data-exposure primitive to an already thin trust boundary. There is no EPSS score, no CISA KEV listing, no public exploit, and no scanner template yet, so this is not being actively exploited in the wild today, but it requires only that a victim load an attacker-supplied or compromised model, which is a routine action in Hugging Face Hub-style workflows, satisfying the CVSS 'user interaction required' condition at low attack complexity and no privileges. Patch to a Diffusers build including commit cee298c (fixed after 0.39.0); until then, restrict which model sources your pipelines are allowed to load via from_pretrained and run model-loading processes with least-privilege filesystem access so a malicious weight_map cannot reach credentials, keys, or source code.

Sources: NVD GitHub Advisory ATLAS OpenSSF vulncheck.com

What is the risk?

Medium severity (CVSS 4.3): network-reachable and low complexity, but scoped to confidentiality only (arbitrary file read) with no integrity or availability impact, and it requires user interaction (the victim must load the malicious model/checkpoint). No EPSS score, no CISA KEV entry, no public exploit code, and no Nuclei template exist, indicating no observed active exploitation yet. Real-world risk is driven less by technical difficulty and more by the trust model of AI pipelines: applications and platforms that auto-pull third-party models from hubs or registries routinely perform the 'user interaction' step attackers need. Diffusers' below-average OpenSSF Scorecard (4.4/10), modest package risk score (26/100), and broad footprint (419 dependents, 3 other CVEs in the package) suggest a maturing but still-hardening security posture worth monitoring rather than an immediate five-alarm issue.

How does the attack unfold?

Malicious Model Delivery

Attacker publishes or compromises a Diffusers-compatible model repository whose model_index.json weight_map contains path-traversal or absolute-path entries instead of legitimate shard filenames.

AML.T0010.003

Victim Loads Model

A user or automated pipeline trusts the source and calls from_pretrained() to load the malicious model, satisfying the required user interaction.

AML.T0011.000

Path Traversal Exploitation

_get_checkpoint_shard_files resolves the malicious weight_map paths without sanitization, escaping the intended model directory via '../' sequences or absolute paths.

AML.T0037

Arbitrary File Read / Data Exposure

Diffusers reads the attacker-targeted file as if it were a model shard, exposing sensitive local data such as credentials or source code to the attacker via errors, logs, or downstream outputs.

Malicious Model Delivery

Attacker publishes or compromises a Diffusers-compatible model repository whose model_index.json weight_map contains path-traversal or absolute-path entries instead of legitimate shard filenames.

AML.T0010.003

Victim Loads Model

A user or automated pipeline trusts the source and calls from_pretrained() to load the malicious model, satisfying the required user interaction.

AML.T0011.000

Path Traversal Exploitation

_get_checkpoint_shard_files resolves the malicious weight_map paths without sanitization, escaping the intended model directory via '../' sequences or absolute paths.

AML.T0037

Arbitrary File Read / Data Exposure

Diffusers reads the attacker-targeted file as if it were a model shard, exposing sensitive local data such as credentials or source code to the attacker via errors, logs, or downstream outputs.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Diffusers	pip	—	No patch
34.5K OpenSSF 5.2 391 dependents Pushed 3d ago 75% patched ~57d to patch Full package profile →

Do you use Diffusers? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 34% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C Low

I None

A None

What should I do?

1 step

Upgrade Diffusers to a version that includes fix commit cee298c1f37c439a9a408396b8283a921238a1c6 (patched after 0.39.0). Until upgraded, only load models from trusted, reviewed sources and avoid auto-loading arbitrary third-party checkpoints into environments with access to secrets or sensitive files. Run model-loading code in a sandboxed, least-privilege environment (dedicated container/user, restricted filesystem mounts, no access to credential stores) so a path-traversal read has nothing sensitive to reach. Add validation/allowlisting of weight_map paths (reject absolute paths and '../' sequences) at the application layer if immediate upgrade isn't possible, and audit logs from model-loading services for read attempts outside expected model directories as a detection signal.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Leakage Supply Chain Model Framework AML.T0010.003 - Model AML.T0011.000 - Unsafe AI Artifacts AML.T0037 - Data from Local System

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - Third-party and customer requirements

NIST AI RMF

GOVERN-6.1 - Third-party AI system and component risk management

OWASP LLM Top 10

LLM05:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-65920?

A path traversal flaw in Diffusers' checkpoint-loading code lets a malicious model's index JSON specify weight_map entries containing '../' sequences or absolute paths, causing the library to read arbitrary files on disk instead of the expected safetensors shard. Diffusers underpins image-generation pipelines with 419 downstream dependents, and its OpenSSF Scorecard of 4.4/10 and package risk score of 26/100 already flag it as a below-average security posture, so this adds a concrete data-exposure primitive to an already thin trust boundary. There is no EPSS score, no CISA KEV listing, no public exploit, and no scanner template yet, so this is not being actively exploited in the wild today, but it requires only that a victim load an attacker-supplied or compromised model, which is a routine action in Hugging Face Hub-style workflows, satisfying the CVSS 'user interaction required' condition at low attack complexity and no privileges. Patch to a Diffusers build including commit cee298c (fixed after 0.39.0); until then, restrict which model sources your pipelines are allowed to load via from_pretrained and run model-loading processes with least-privilege filesystem access so a malicious weight_map cannot reach credentials, keys, or source code.

Is CVE-2026-65920 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-65920, increasing the risk of exploitation.

How to fix CVE-2026-65920?

Upgrade Diffusers to a version that includes fix commit cee298c1f37c439a9a408396b8283a921238a1c6 (patched after 0.39.0). Until upgraded, only load models from trusted, reviewed sources and avoid auto-loading arbitrary third-party checkpoints into environments with access to secrets or sensitive files. Run model-loading code in a sandboxed, least-privilege environment (dedicated container/user, restricted filesystem mounts, no access to credential stores) so a path-traversal read has nothing sensitive to reach. Add validation/allowlisting of weight_map paths (reject absolute paths and '../' sequences) at the application layer if immediate upgrade isn't possible, and audit logs from model-loading services for read attempts outside expected model directories as a detection signal.

What systems are affected by CVE-2026-65920?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines.

What is the CVSS score for CVE-2026-65920?

CVE-2026-65920 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.40%.

What is the AI security impact?

Affected AI Architectures

model servingtraining pipelines

MITRE ATLAS Techniques

AML.T0010.003 Model

AML.T0011.000 Unsafe AI Artifacts

AML.T0037 Data from Local System

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: GOVERN-6.1

OWASP LLM Top 10: LLM05:2025

What are the technical details?

Original Advisory

Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _get_checkpoint_shard_files function that allows attackers to read arbitrary files by supplying malicious weight_map values in model index JSON. Attackers can use ../ sequences or absolute paths in weight_map entries to escape the model directory and read safetensors files outside the intended location during model loading.

Exploitation Scenario

An attacker publishes a diffusion model repository on Hugging Face Hub (or compromises an existing one via account takeover or a supply-chain rug pull) whose model_index.json weight_map contains entries such as '../../../.aws/credentials' or an absolute path to a secrets file instead of a legitimate shard filename. A victim's application or a developer, trusting the model source, calls diffusers' from_pretrained() to load the model — the required user interaction. Internally, _get_checkpoint_shard_files resolves the malicious weight_map entries without sanitizing them, so Diffusers opens and reads the attacker-specified file from outside the model directory, exposing its contents through resulting errors, logs, or any downstream code path that surfaces the 'loaded shard' data back to the attacker or into an accessible output.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.