Is there a public PoC exploit available for CVE-2026-65920?

Yes, a public proof-of-concept exploit is available for CVE-2026-65920. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for CVE-2026-65920?

Yes, a patch is available for CVE-2026-65920. Update the affected software to the latest version immediately.

HuggingFace Diffusers CVE-2026-65920

Q: What is the CVSS score of CVE-2026-65920?

CVE-2026-65920 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-48343 MEDIUM

Path Traversal (CWE-22)

2026-07-23 VulnCheck

GHSA-9576-hw58-7552

Path Traversal Red Hat Hugging Face Diffusers

5.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Victim must actively load a malicious model (UI:R); no attacker privileges needed (PR:N); confidentiality limited to files readable by the process (C:L); no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

4.3 MEDIUM

qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 18:23 vuln.today

Analysis Generated

Jul 23, 2026 - 18:23 vuln.today

CVE Published

Jul 23, 2026 - 17:43 cve.org

MEDIUM 5.3

DescriptionCVE.org

Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _get_checkpoint_shard_files function that allows attackers to read arbitrary files by supplying malicious weight_map values in model index JSON. Attackers can use ../ sequences or absolute paths in weight_map entries to escape the model directory and read safetensors files outside the intended location during model loading.

AnalysisAI

Path traversal in HuggingFace Diffusers through 0.39.0 enables arbitrary file reads when a user or pipeline loads a maliciously crafted model. The _get_checkpoint_shard_files function in hub_utils.py blindly resolves weight_map shard filenames from model index JSON without validating for path separators or absolute paths, allowing an attacker who controls a model repository to escape the model directory and read any file accessible to the Diffusers process. No active exploitation confirmed (not in CISA KEV), but a public POC issue exists on GitHub and the attack surface includes the widely-used HuggingFace Hub ecosystem.

Technical ContextAI

The vulnerable function _get_checkpoint_shard_files (src/diffusers/utils/hub_utils.py) reads a shard index JSON file (e.g., diffusion_pytorch_model.safetensors.index.json) and iterates over weight_map entries that map model parameter names to shard filenames within the model directory. Because the filenames were not sanitized, an attacker-controlled index could supply values such as ../secret/SECRET.safetensors or /home/user/.ssh/id_rsa.safetensors, causing the library to resolve and read paths outside the intended model directory. Root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal). The fix in commit cee298c adds a single validation: os.path.basename(shard_filename) != shard_filename raises a ValueError for any filename containing a path separator or parent-directory reference. Tests in PR #14182 confirm rejection of ../, absolute paths, and subdirectory components. Affected CPE: cpe:2.3:a:huggingface:diffusers:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade HuggingFace Diffusers to any release incorporating commit cee298c - verify via pip show diffusers and cross-reference the package changelog, as the exact first patched release version is not confirmed from available data (upstream fix is in PR #14182 at https://github.com/huggingface/diffusers/pull/14182). As an immediate compensating control pending upgrade, audit any model index JSON files (*.safetensors.index.json) before loading - specifically grep weight_map values for ../, /, or absolute path strings and reject models containing them; this adds a manual review step but has no functional side effects. Running the Diffusers process under a least-privilege OS user or within a container with a minimal read-only filesystem mount (restricting access outside the model cache directory) limits exfiltration scope if exploitation occurs, at the cost of added operational complexity. Avoid loading models from untrusted or unreviewed sources on HuggingFace Hub until the library is patched.