Home Assistant Core CVE-2025-65713

Exploitation requires that the optional Downloader integration is configured (it is not part of a default Home Assistant install and must be set up with a download directory), and the attacker must be able to call the downloader.download_file service supplying a malicious subdir value - the patch shows the flaw is that subdir was concatenated into the target path without validation (the fix adds raise_if_invalid_path and rejects absolute paths). Limiting factors: the Downloader integration must be enabled; the download_file service must be reachable; and invoking Home Assistant services normally requires an authenticated session or access token, so this is not plausibly reachable by a fully unauthenticated remote attacker against a default deployment despite the PR:N in the published vector.

This is a moderate, not urgent, issue and the signals are consistent in pointing away from widespread exploitation. The official CVSS 3.1 base score is 4.0 (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), EPSS is low at 0.40% (34th percentile), the vulnerability is NOT in CISA KEV, and the vuln.today decision label is 'this_month' rather than act_now or emergency - so there is no 'no public exploit identified' claim to make (a PoC reference exists) but also no evidence of active exploitation. The exploitation status is: a public PoC reference exists (a GitHub gist); it is not verified as working exploit code. Two data points conflict and should be verified: (1) the official vector marks this C:L/I:N, yet the underlying flaw is a Downloader integration that concatenates an attacker-supplied subdir into a write path - a path-traversal write affects integrity, not confidentiality, so the impact labeling appears mislabeled relative to the mechanism shown in the patch. (2) The official vector marks PR:N, but the flaw is reached only through the downloader.download_file service, and invoking a Home Assistant service requires an authenticated session or token - so unauthenticated exploitation (PR:N) is questionable; verify with the vendor. Overall this is a genuine but low-to-moderate-priority defect best handled on a normal patch cycle, not an emergency.

An actor with the ability to invoke Home Assistant service calls (an authenticated user or a leaked long-lived token) calls the downloader.download_file service with a crafted subdir containing '../' traversal sequences, causing the downloaded content to be written outside the configured download directory. A public PoC reference (a GitHub gist) exists but is not verified as working exploit code. Because the download target is attacker-influenced, this can be used to drop or overwrite files in sensitive locations within the Home Assistant host's filesystem.