The huggingface diffusers library versions up to and including 0.39.0 contain a path traversal vulnerability in the _get_checkpoint_shard_files function. This vulnerability arises because the function does not properly restrict pathname inputs, allowing an attacker to craft malicious weight_map entries in the model index JSON. By including directory traversal sequences (../) or absolute paths, an attacker can escape the intended model directory and read safetensors files located elsewhere on the filesystem during model loading. The vulnerability is addressed in a commit identified as cee298c, which presumably implements proper pathname restrictions to prevent traversal.

An attacker can read arbitrary files on the filesystem accessible to the application by exploiting the path traversal vulnerability during model loading. This could lead to unauthorized disclosure of sensitive information stored in files outside the model directory. There is no indication of privilege escalation, code execution, or modification of files. The vulnerability requires user interaction (UI:P) and has low complexity (AC:L) with no privileges required (PR:N).

A fix is available and has been implemented in the commit identified as cee298c. Users of huggingface diffusers should upgrade to a version that includes this fix (versions later than 0.39.0). Since the vendor advisory or patch links are not explicitly provided, users should consult the official huggingface diffusers repository or release notes to obtain the patched version. Until upgraded, avoid loading untrusted model index JSON files containing weight_map entries.