Skip to content
Sign in
6.9 Medium

CVE-2026-66007 Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset…

Description

Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called.

Affected products and versions

Product Affected versions Fixed in
datasets 5.0 earliest → 5.0.0 No fix stated

Other CVEs of datasets

The 3 CVEs of datasets →
CVE-2026-57845 Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to… 8.7 High CVE-2026-65010 Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract() that… 4.4 Medium
Track this CVE