CVE-2026-75104

5.5 Moyenne

Publiée le 17/08/2026 à 23:16 · Modifiée le 23/10/2026 à 18:10 · En attente d'analyse NVD · Source : disclosure@vulncheck.com

Description

Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling file disclosure and filesystem reconnaissance.

Traduire en français

Produits concernés

huggingface transformers

Scores CVSS

Version	Score	Source	Vecteur
4.0	6.8 Moyenne	disclosure@vulncheck.com	`CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	5.5 Moyenne	disclosure@vulncheck.com	`CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-22

Références

https://github.com/huggingface/transformers
https://github.com/huggingface/transformers/blob/main/src/transformers/utils/hub.py
https://github.com/huggingface/transformers/issues/47176
https://github.com/huggingface/transformers/issues/47177
https://www.vulncheck.com/advisories/hugging-face-transformers-path-traversal-via-checkpoint-index
https://github.com/huggingface/transformers/issues/47176

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories