Aller au contenu
en Se connecter
5.3 Moyenne

CVE-2026-65920 Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the…

Description

Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _get_checkpoint_shard_files function that allows attackers to read arbitrary files by supplying malicious weight_map values in model index JSON. Attackers can use ../ sequences or absolute paths in weight_map entries to escape the model directory and read safetensors files outside the intended location during model loading.

Produits et versions touchés

Produit Versions touchées Corrigé en
diffusers 0.39 premières → 0.39.0 Pas de correctif indiqué

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de diffusers

Les 4 CVE de diffusers →
CVE-2026-45804 Diffusers is the a library for pretrained diffusion models 7.5 Élevée CVE-2026-44827 Diffusers is the a library for pretrained diffusion models 8.8 Élevée CVE-2026-44513 Diffusers is the a library for pretrained diffusion models 8.8 Élevée
Suivre cette CVE