CVE-2026-75104: Hugging Face Transformers Path Traversal via Checkpoint Index
Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling file disclosure and filesystem reconnaissance.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-75104?
The severity of CVE-2026-75104 is rated as medium with a score of 5.5.
What is the risk associated with CVE-2026-75104?
CVE-2026-75104 has a risk level of 31.
How can I fix CVE-2026-75104?
To fix CVE-2026-75104, ensure that you validate shard filenames in checkpoint index files to prevent unauthorized file access.
What type of vulnerability is CVE-2026-75104?
CVE-2026-75104 is classified as a Path Traversal vulnerability.
What can attackers do with CVE-2026-75104?
Attackers can exploit CVE-2026-75104 to read arbitrary files outside the model directory by supplying malicious index files.