CVE-2026-75104 - Hugging Face Transformers Path Traversal via Checkpoint Index
Brief
CVE ID : CVE-2026-75104
Published : Aug. 17, 2026, 8:36 p. m.
- 31 minutes ago
Description : Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling file disclosure and filesystem reconnaissance.
Severity: 6.8
- MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...