CVE-2026-75104

Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling file disclosure and filesystem reconnaissance.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/huggingface/transformers
https://github.com/huggingface/transformers/blob/main/src/transformers/utils/hub.py
https://github.com/huggingface/transformers/issues/47176
https://github.com/huggingface/transformers/issues/47177
https://www.vulncheck.com/advisories/hugging-face-transformers-path-traversal-via-checkpoint-index
https://github.com/huggingface/transformers/issues/47176

Configurations

No configuration.

History

23 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) Hugging Face Transformers falla al validar los nombres de archivo de fragmento en los archivos de índice de punto de control, permitiendo a los atacantes leer archivos arbitrarios fuera del directorio del modelo. Los atacantes pueden proporcionar archivos de índice maliciosos con referencias a directorios padre o rutas absolutas que se unen sin validación, habilitando la divulgación de archivos y el reconocimiento del sistema de archivos.

Information

Published : 2026-08-17 21:16

Updated : 2026-10-23 16:10

NVD link : CVE-2026-75104

Mitre link : CVE-2026-75104

CVE.ORG link : CVE-2026-75104

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-75104", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-75104", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-18T12:39:44.371007Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/huggingface/transformers", "vendor": "huggingface", "product": "transformers", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "5.15.0"}], "packageURL": "pkg:pypi/transformers", "defaultStatus": "unaffected"}]}], "published": "2026-08-17T21:16:49.340", "references": [{"url": "https://github.com/huggingface/transformers", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/huggingface/transformers/blob/main/src/transformers/utils/hub.py", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/huggingface/transformers/issues/47176", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/huggingface/transformers/issues/47177", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/hugging-face-transformers-path-traversal-via-checkpoint-index", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/huggingface/transformers/issues/47176", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling file disclosure and filesystem reconnaissance."}, {"lang": "es", "value": "Hugging Face Transformers falla al validar los nombres de archivo de fragmento en los archivos de \u00edndice de punto de control, permitiendo a los atacantes leer archivos arbitrarios fuera del directorio del modelo. Los atacantes pueden proporcionar archivos de \u00edndice maliciosos con referencias a directorios padre o rutas absolutas que se unen sin validaci\u00f3n, habilitando la divulgaci\u00f3n de archivos y el reconocimiento del sistema de archivos."}], "lastModified": "2026-10-23T16:10:00.313", "sourceIdentifier": "disclosure@vulncheck.com"}