CVE-2026-65920
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A path traversal vulnerability was found in Diffusers up to version 0.39.0 in the _get_checkpoint_shard_files function. Attackers can supply malicious weight_map values in model index JSON, containing ../ sequences or absolute paths, allowing reading of safetensors files outside the intended directory.
Risk Assessment
An attacker can remotely read arbitrary safetensors files on the server, potentially leaking sensitive model data.
Recommendation
Update Diffusers to a version containing commit cee298c or later.
Other vulnerabilities in Diffusers
See all- CVE-2026-45804High
A vulnerability in the Diffusers library before version 0.38.0 allows bypassing the trust_remote_code guard. The download() method validates model_index.json and custom pipeline code but later loads from a cached folder that can change, enabling execution of malicious .py code from a Hub repository without requiring trust_remote_code=True.
- CVE-2026-44513High
The Diffusers library before version 0.38.0 contains a vulnerability that bypasses the trust_remote_code protection. An attacker can execute arbitrary remote code even when trust_remote_code is set to False or omitted. The issue stems from a flawed implementation of the security check in the download() function, which can be bypassed through alternative code paths.
Original NVD description (English source)
Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _get_checkpoint_shard_files function that allows attackers to read arbitrary files by supplying malicious weight_map values in model index JSON. Attackers can use ../ sequences or absolute paths in weight_map entries to escape the model directory and read safetensors files outside the intended location during model loading.