CVE-2026-65920 in diffusers
Summary
by MITRE • 07/23/2026
Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _get_checkpoint_shard_files function that allows attackers to read arbitrary files by supplying malicious weight_map values in model index JSON. Attackers can use ../ sequences or absolute paths in weight_map entries to escape the model directory and read safetensors files outside the intended location during model loading.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/23/2026
The vulnerability exists within the diffusers library version 0.39.0 and earlier, specifically in the _get_checkpoint_shard_files function where improper input validation allows for path traversal attacks. This flaw resides in the model index JSON processing mechanism that handles weight_map entries during model loading operations. The issue stems from insufficient sanitization of file paths provided in the weight_map parameter, which can contain malicious path sequences that bypass normal directory restrictions.
The technical implementation of this vulnerability allows attackers to manipulate the weight_map values within model index JSON files to include ../ path traversal sequences or absolute file paths. When the _get_checkpoint_shard_files function processes these malicious entries, it fails to properly validate or sanitize the input paths before attempting to access corresponding safetensors files. This creates an opportunity for unauthorized file system access where attackers can escape the intended model directory boundaries and read arbitrary files from the system.
The operational impact of this vulnerability is significant as it enables remote code execution through file reading capabilities, potentially allowing attackers to access sensitive information stored in adjacent directories or even system-level files. The vulnerability affects any application using diffusers library versions prior to the fix implemented in commit cee298c, making it particularly dangerous for web applications and services that load machine learning models from untrusted sources. Attackers could leverage this to extract model weights, configuration files, or other sensitive data that should remain protected within the application's designated directories.
Security mitigations for this vulnerability include upgrading to diffusers version that includes commit cee298c which implements proper path validation and sanitization in the _get_checkpoint_shard_files function. Organizations should also implement strict input validation for model index JSON files, particularly when loading models from external or untrusted sources. The vulnerability aligns with CWE-22 Path Traversal and can be categorized under ATT&CK technique T1059 Command and Scripting Interpreter for potential exploitation paths. Additional protective measures include restricting file system permissions for model directories, implementing application sandboxing, and using automated tools to scan model files for malicious path sequences before loading them into memory.